> ## Documentation Index
> Fetch the complete documentation index at: https://developers.techwolf.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# User Management
# Managing access to the TechWolf Analyst Agent
Your own administrators manage agent access, per user, in the TechWolf
Console's **User Management**. It is the same user management you already use
for Console access; there is no separate admin surface.
Two independent things determine what a user can do:
* **Whether they can reach the agent:** the **Viewer** role under **TechWolf
Agent**, assigned per user.
* **What they see once inside:** their **Data Foundation** roles and entity
access. The agent never widens access.
Signing in through single sign-on is not by itself enough to reach the
agent. Nobody has the agent role until an administrator assigns it; a user
without it sees a no-access message.
# Granting access
Any user who can manage users in your Console can grant agent access.
In the TechWolf Console, go to **User Management**. Use **Add users**
to add a new user, or **Edit users** to update an existing one.
The **Data Foundation** roles determine which data the user, and so the
agent on their behalf, is allowed to see. Confirm they match what you
expect the user to be able to analyse; see [What determines what a user
sees](#what-determines-what-a-user-sees).
Under **TechWolf Agent**, set **Roles** to **Viewer**, then select
**Add** (or save your changes for an existing user).
Access changes apply immediately. Users do not need to sign out and
back in.
To see who has access today, review the **Analyst Agent** column in **User
Management**. To remove access, clear the user's **Viewer** role there; this
also takes effect immediately.
# What determines what a user sees
The agent inherits each user's Console access exactly. If a user cannot see
something in the Console, the agent will not show it or reason over it on their
behalf. These are the settings that shape the answers a user gets:
| Console access | Effect in the agent |
| ----------------------- | ---------------------------------------------- |
| **Skill Supply Roles** | Whether the user sees employee skills at all |
| **Employee Org Units** | Which employees are in scope |
| **Skill Demand Roles** | Whether the user sees job skills at all |
| **Tasks on Jobs Roles** | Whether the user sees job tasks |
| **Jobs** | Which jobs are in scope, all or a named subset |
A user whose access is narrowed gets a correspondingly narrower answer, not
an error. If an answer looks incomplete, check the user's data access
first.
A user cannot be given view access to all jobs while owning only some of
them. If a user owns a subset of jobs, they see only that subset, and the
agent answers accordingly. Differing view permissions per job are not
supported today.
# Which data the agent can draw on
Separately from per-user access, the agent only uses the TechWolf data products
your organization subscribes to. These dataset entitlements are enforced
server-side on every request, **default-deny** and applied **per tenant**, not
per user. A tenant scoped to Market Intelligence receives only Market
Intelligence; when a question needs data outside your subscription, the agent
explains what is not covered rather than returning a partial answer. Access is
**read-only by construction**: the agent cannot execute actions in any HR
system.
Restricting specific user groups *within* a tenant to a subset of data
sources is a roadmap item rather than a capability available today.
Entitlements are applied at the tenant level.
# Access through Microsoft 365 Copilot
Reaching the agent through Copilot changes nothing about who can see what.
Every message carries a verified Microsoft Entra identity, resolved to that
user's existing TechWolf role and data scope before any data is read. Users
still need the **Viewer** role, assigned exactly as above. See [How It
Works](./copilot/how-it-works) for the full identity and access model.
# Troubleshooting
* **A user cannot open the agent.** Confirm the **Viewer** role is assigned
under **TechWolf Agent**. This is the most common cause.
* **A user sees fewer employees or jobs than expected.** This is data access
working as intended. Review their organizational unit and job access.
* **Nobody in the organization can open the agent.** Contact
[support@techwolf.ai](mailto:support@techwolf.ai). Access checks fail closed,
so a temporary service issue results in access being denied, never granted.