Access Control¶
Ebla AI uses EspoCRM Roles and normal record access. An AI permission never grants access to CRM data by itself.
Open Administration > Roles, edit the role, and grant only the AI features its users need.
AI permissions¶
| Permission | Controls |
|---|---|
| AI | Base access used by general generation features |
| AI Chat | Chat, conversations, CRM search, attached files, and approved Chat actions |
| AI Web Search | Provider-supported internet search from Chat |
| AI Email Composer | Email drafting, replies, polish, translation, and Email Analysis |
| AI Field Action | Text-field and stream-comment actions |
| AI Create | Create with AI |
| AI Templates | Email and PDF template generation |
| AI Formula | Ebla AI formula functions |
| AI Record Summary | Summary panel access and generation |
| AI Smart Paste | Smart Paste |
AI Profiles, AI Prompts, AI Log, and AI Token Usage are normal EspoCRM scopes. Configure their create, read, edit, and delete access like other entities.
Data access¶
Every CRM-aware request also checks the user's normal access:
- Scope permission
- Record permission
- Field-level security
- Relationship and stream permission
- Create, edit, delete, or mass-update permission for changes
- AI-specific field exclusions
If a user cannot read a field in EspoCRM, Chat must not search it or return it.
Common requirements¶
| Feature | Required access |
|---|---|
| Chat | AI Chat, plus access to every record and field used |
| Internet search | AI Chat and AI Web Search |
| Summary | AI Record Summary read; create for the first summary; edit for regeneration |
| Smart Paste | AI and AI Smart Paste, plus create or edit access to the target entity |
| Create with AI | AI and AI Create, plus create access to the target entity |
| Email tools and analysis | AI and AI Email Composer, plus the required Email access |
| Template generation | AI and AI Templates, plus create access to the template entity |
| Field and stream actions | AI and AI Field Action |
| Image generation from a field | AI, plus access to the record and target field |
| Formula functions | AI and AI Formula |
Chat attachments¶
Two attachment paths have different checks:
- A file uploaded directly into Chat requires AI Chat access and must belong to the current user.
- A file already stored in CRM requires access to its source record and readable file field.
A Document selected for Chat follows the same Document scope and record access configured under EspoCRM Roles.
Changes from Chat¶
Chat never treats model output as authorization. Mutating actions are stored as an exact server-side approval checkpoint and shown to the user for confirmation.
The server rejects changed, expired, replayed, or unsigned approvals. Administrative tools also require the acting user to be an administrator.
Suggested role pattern¶
- Grant AI Chat to users who need CRM questions and document assistance.
- Add AI Web Search only when public internet lookup is appropriate.
- Add content, email, summary, or creation permissions only for the teams that use them.
- Keep AI configuration, logs, and administrative tools restricted.
- Test every role with a non-admin account, including field-level restrictions.
See EspoCRM's Role Management documentation for how multiple roles, team access, and field-level security are combined.
Token limits¶
Token quotas are usage controls, not data permissions. See Token Usage for user, team, and global limits.