Managing access

Opening Identity and Access Management

1. Open the Manage menu .

2. Click Manage users.

3. In Access and permissions, click Identity and Access Management in step 2.

   

Adding users in Identity and Access Management

1. In IAM, click Invite users.

2. Enter the email address of the person who needs access.

3. In How do you want to assign access?, choose Access policy.

   

4. In Service, choose watsonx Assistant, then click Next.

   

5. In Resources, choose either All resources or Specific resources.

   If you choose All resources, the user can access all the instances of watsonx Assistant in your account.

   If you choose Specific resources, you can narrow access in Attribute type. With this setting, you might need to add multiple access policies for a user to grant the correct access. For more information, see Example of limiting access to one assistant.

   Choices include:

   Attribute types

   Resource attribute type	Description
   Service Instance	Choose a specific service instance of watsonx Assistant
   Assistant, Environment, or Skill ID	Enter the ID value for the resource. Use the Assistant IDs and API details section in Assistant settings to get the ID values for your assistant, environments, action skill, or dialog skill.
   Resource Type	If you enter an ID value, choose Assistant ID, Environment ID, or Skill ID to identify the ID type
   Region	Choose a specific region (for example, Dallas or London)
   Resource Group	Enter or choose a resource group that you created

   

6. In Roles and actions, select the service role that you want the user to have. Service access controls what a person can do in watsonx Assistant. Next, select the platform role that you want the user to have. Platform access controls a person's ability to access a service instance in IBM Cloud. Then, click Review.

   

7. Click Add to add the access policy.

   

8. To finish, click Invite.

   

The user that you invited appears in your list with the status of Processing. After they accept the invite, status changes to Active, and the user can work on your assistant with you.

Platform roles

A platform role controls a user's ability to open and work with a service instance in IBM Cloud.

At a minimum, each user needs the Viewer platform role for a service instance

Platform role details

Role	Open	Modify	Delete	Manage access
Viewer
Operator
Editor
Administrator

Service roles

A service role controls what a person can do within each service instance.

This table explains the minimum service roles that are required for common tasks in an assistant.

Example of limiting access to one assistant

This example explains how to follow the steps in Adding users from the Manage menu and set specific resources that limit a user to building and publishing actions in one assistant. For each user, you need to add three access policies that identify the service instance, assistant ID, and skill ID. (Use Assistant settings to get the ID values for your assistant and action skill.)

This table lists the values that you need to add for each policy:

The access policies for your user should look like this example:

With this set of access policies, your user can build and publish actions in one assistant. The user can't add integrations because the service instance is set to Reader. The user has read-only access to other assistants but can't build or publish actions.