Skip to main content

​
Managing access to the TechWolf Analyst Agent

Your own administrators manage agent access, per user, in the TechWolf Console’s User Management. It is the same user management you already use for Console access; there is no separate admin surface. Two independent things determine what a user can do:
  • Whether they can reach the agent: the Viewer role under TechWolf Agent, assigned per user.
  • What they see once inside: their Data Foundation roles and entity access. The agent never widens access.
Signing in through single sign-on is not by itself enough to reach the agent. Nobody has the agent role until an administrator assigns it; a user without it sees a no-access message.

​
Granting access

Any user who can manage users in your Console can grant agent access.
1

Open the user in User Management

In the TechWolf Console, go to User Management. Use Add users to add a new user, or Edit users to update an existing one.
Adding a user in the TechWolf Console

Add a user in User Management.

2

Check the user's Data Foundation roles

The Data Foundation roles determine which data the user, and so the agent on their behalf, is allowed to see. Confirm they match what you expect the user to be able to analyse; see What determines what a user sees.
Data Foundation roles

Assign the user's data roles.

3

Grant the agent role

Under TechWolf Agent, set Roles to Viewer, then select Add (or save your changes for an existing user).
TechWolf Agent role set to Viewer

Grant the TechWolf Agent role, then add the user.

Access changes apply immediately. Users do not need to sign out and back in.
To see who has access today, review the Analyst Agent column in User Management. To remove access, clear the user’s Viewer role there; this also takes effect immediately.

​
What determines what a user sees

The agent inherits each user’s Console access exactly. If a user cannot see something in the Console, the agent will not show it or reason over it on their behalf. These are the settings that shape the answers a user gets:
A user whose access is narrowed gets a correspondingly narrower answer, not an error. If an answer looks incomplete, check the user’s data access first.
A user cannot be given view access to all jobs while owning only some of them. If a user owns a subset of jobs, they see only that subset, and the agent answers accordingly. Differing view permissions per job are not supported today.

​
Which data the agent can draw on

Separately from per-user access, the agent only uses the TechWolf data products your organization subscribes to. These dataset entitlements are enforced server-side on every request, default-deny and applied per tenant, not per user. A tenant scoped to Market Intelligence receives only Market Intelligence; when a question needs data outside your subscription, the agent explains what is not covered rather than returning a partial answer. Access is read-only by construction: the agent cannot execute actions in any HR system.
Restricting specific user groups within a tenant to a subset of data sources is a roadmap item rather than a capability available today. Entitlements are applied at the tenant level.

​
Access through Microsoft 365 Copilot

Reaching the agent through Copilot changes nothing about who can see what. Every message carries a verified Microsoft Entra identity, resolved to that user’s existing TechWolf role and data scope before any data is read. Users still need the Viewer role, assigned exactly as above. See How It Works for the full identity and access model.

​
Troubleshooting

  • A user cannot open the agent. Confirm the Viewer role is assigned under TechWolf Agent. This is the most common cause.
  • A user sees fewer employees or jobs than expected. This is data access working as intended. Review their organizational unit and job access.
  • Nobody in the organization can open the agent. Contact support@techwolf.ai. Access checks fail closed, so a temporary service issue results in access being denied, never granted.