> ## Documentation Index > Fetch the complete documentation index at: https://docs.xpertai.cn/llms.txt > Use this file to discover all available pages before exploring further. # Feature Permission Matrix > Features, permissions, and roleNames required by pages, functions, and buttons. This page lists the feature switches and permissions required by each function, page, and button. Unless otherwise noted: * When multiple features are listed together, all of them must be enabled. * When multiple permissions or roleNames are listed together, matching any one of them is usually enough to access the entry. * Page entries, button visibility, and backend operations can be controlled at different layers. A function is actually usable only when both the UI condition and the backend permission allow it. * When `roleName` means a platform role, possible values are `SUPER_ADMIN`, `ADMIN`, `AI_BUILDER`, `ANALYTICS_BUILDER`, `VIEWER`, and `TRIAL`. ## Main Navigation | Function / Page | Path | Required feature | Required permission / roleName | Notes | | --------------------- | ---------------- | --------------------------------------------- | ------------------------------- | --------------------------------------------------------------------------------------------------------- | | Chat | `/chat` | `FEATURE_XPERT` | `CHAT_VIEW` | The Chat entry is visible only when both the feature and permission are available. | | Explore Xperts | `/explore` | `FEATURE_XPERT` | `XPERT_EDIT` | Used to browse and explore Xperts. | | Xpert Workspace | `/xpert` | `FEATURE_XPERT` | `XPERT_EDIT` | After entering the workspace, concrete read/write actions are still controlled by workspace capabilities. | | Story | `/story` | No explicit main-navigation switch | `STORIES_VIEW` | This entry is not currently in the main navigation, but page access requires story view permission. | | Data | `/data` | Controlled by child functions | `MODELS_EDIT` or `STORIES_EDIT` | The parent Data route requires either model edit or story edit permission. | | Data / Project | `/data/project` | `FEATURE_PROJECT` | `STORIES_EDIT` | BI project entry. | | Data / Semantic Model | `/data/models` | `FEATURE_MODEL` | `MODELS_EDIT` | Semantic model entry and modeling operations. | | Indicator App | `/indicator-app` | `FEATURE_INDICATOR` + `FEATURE_INDICATOR_APP` | `INDICATOR_MARTKET_VIEW` | Indicator app entry. | | Settings | `/settings` | `FEATURE_SETTING` | No unified entry permission | Each menu inside Settings is controlled separately. | ## Chat And Agents | Function / Page / Button | Path or entry | Required feature | Required permission / roleName | Notes | | --------------------------------- | ----------------------------- | ------------------------------------------- | -------------------------------------------- | ------------------------------------------------------- | | Common Assistant | `/chat/x/common` | Inherits `FEATURE_XPERT` from the entry | Inherits `CHAT_VIEW` from the entry | Common chat assistant. | | ClawXpert | `/chat/clawxpert` | `FEATURE_XPERT` + `FEATURE_XPERT_CLAWXPERT` | No extra permission | Both features must be enabled. | | ChatBI | `/chat/chatbi` | `FEATURE_XPERT` + `FEATURE_XPERT_CHATBI` | No extra permission | Both features must be enabled. | | Chat sidebar ChatBI | Chat sidebar | `FEATURE_XPERT_CHATBI` | No extra permission | Controls entry visibility only. | | Chat sidebar CodeXpert | Chat sidebar | `FEATURE_XPERT_CODEXPERT` | No extra permission | External link entry. | | Chat sidebar DeepResearch | Chat sidebar | `FEATURE_XPERT_DEEP_RESEARCH` | No extra permission | External link entry. | | Change Settings button | Common Assistant welcome page | No extra feature | `SUPER_ADMIN` or `ADMIN` | Opens Assistants settings. | | Common Assistant configuration | Assistants settings | `FEATURE_XPERT` | Page entry requires `SUPER_ADMIN` or `ADMIN` | System assistant configuration. | | Workspace Assistant configuration | Assistants settings | `FEATURE_XPERT` | Page entry requires `SUPER_ADMIN` or `ADMIN` | Shared assistant configuration for the Xpert workspace. | | ChatBI Assistant configuration | Assistants settings | `FEATURE_XPERT` + `FEATURE_XPERT_CHATBI` | Page entry requires `SUPER_ADMIN` or `ADMIN` | ChatBI assistant configuration. | | ClawXpert Assistant configuration | User-level ClawXpert binding | `FEATURE_XPERT` + `FEATURE_XPERT_CLAWXPERT` | User-level configuration | Not included in the system assistant list. | ## Settings Pages | Function / Page | Path | Required feature | Required permission / roleName | Notes | | ------------------ | -------------------------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------- | | Account | `/settings/account` | None | None | Personal account settings. | | AI Copilot | `/settings/copilot` | `FEATURE_COPILOT` | `COPILOT_EDIT` | Copilot basic configuration, examples, usage, users, and related settings. | | Data Sources | `/settings/data-sources` | `FEATURE_MODEL` | `DATA_SOURCE_EDIT` | Data source settings entry. | | Assistants | `/settings/assistants` | `FEATURE_XPERT` | `SUPER_ADMIN` or `ADMIN` | Tenant default configuration is editable only by `SUPER_ADMIN`; organization overrides require a selected organization. | | Chat BI | `/settings/chatbi` | `FEATURE_XPERT` + `FEATURE_MODEL` | `MODELS_EDIT` | ChatBI model settings. | | Business Area | `/settings/business-area` | `FEATURE_BUSINESS_AREA` | `BUSINESS_AREA_EDIT` | Business area settings. | | Certification | `/settings/certification` | None | Entry visibility requires `CERTIFICATION_EDIT`; page access also depends on `BUSINESS_AREA_EDIT` | Both permissions need attention in the current behavior. | | System Integration | `/settings/integration` | `FEATURE_INTEGRATION` | `INTEGRATION_EDIT` | Integration list, create, view, and edit. | | Users | `/settings/users` | `FEATURE_USER` | Any of `ALL_ORG_VIEW` / `ALL_ORG_EDIT` / `ORG_USERS_VIEW` / `ORG_USERS_EDIT` | User list entry. Buttons are split further. | | Groups | `/settings/groups` | `FEATURE_USER` | View: `ORG_USERS_VIEW`; edit: `ORG_USERS_EDIT` | User group list and maintenance. | | Roles | `/settings/roles` | `FEATURE_ROLES_PERMISSION` | `CHANGE_ROLES_PERMISSIONS` | Role and permission maintenance. | | Feature | `/settings/features/tenant`, `/settings/features/organization` | None | Page entry: `CHANGE_ROLES_PERMISSIONS`; read features: `ALL_ORG_VIEW`; update switches: `ALL_ORG_EDIT` | Tenant and organization feature switch maintenance. | | Organizations | `/settings/organizations` | None | Any of `ALL_ORG_VIEW` / `ALL_ORG_EDIT` / `ORG_USERS_VIEW` / `ORG_USERS_EDIT` | Organization list and details. Buttons are split further. | | Email Template | `/settings/email-templates` | `FEATURE_EMAIL_TEMPLATE` | `VIEW_ALL_EMAIL_TEMPLATES` | Email template management. | | Custom SMTP | `/settings/custom-smtp` | `FEATURE_SMTP` | `CUSTOM_SMTP_VIEW` | Tenant or organization SMTP configuration. | | Plugins | `/settings/plugins` | None | `SUPER_ADMIN` or `ADMIN` or `TRIAL` | Plugin settings entry. | | Tenant | `/settings/tenant` | None | `SUPER_ADMIN` | Tenant settings, tenant skills, and tenant tags. | ## Settings Buttons And Actions | Function / Page | Button or action | Required feature | Required permission / roleName | Notes | | ------------------- | --------------------------------------------- | -------------------------------------------- | --------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | | Users | Batch Import | `FEATURE_USER` | UI button: tenant scope + `ALL_ORG_EDIT`; actual import: `SUPER_ADMIN` or `ADMIN` | Bulk user import. | | Users | New | `FEATURE_USER` | Tenant scope + `ALL_ORG_EDIT` | Create user. | | Users | Invite button | `FEATURE_USER` | Organization scope + `ORG_INVITE_VIEW` or `ORG_INVITE_EDIT` | Button visibility condition. Actually creating invites requires `ORG_INVITE_EDIT`. | | Users | Invite list | `FEATURE_USER` | `ORG_INVITE_VIEW` or `ORG_INVITE_EDIT` | View invite records. | | Users | Resend / delete invite | `FEATURE_USER` | `ORG_INVITE_EDIT` | Invite maintenance operations. | | Users | Change user role | `FEATURE_USER` | Current user is `SUPER_ADMIN` or `ADMIN` | Editing a super admin user is additionally protected by super-admin-related permissions. | | Organizations | Create organization | None | Tenant scope + `ALL_ORG_EDIT` | Create organization. | | Organizations | Delete organization | None | Tenant scope + `ALL_ORG_EDIT` | Delete organization. | | Organizations | Save basic organization information | None | Selected organization + `ALL_ORG_EDIT` | Save name, description, status, and similar fields. | | Organizations | Upload organization avatar | None | Selected organization + `ALL_ORG_EDIT` | Change organization avatar. | | Organizations | Governance fields | None | Tenant scope + `ALL_ORG_EDIT` | Currency, timezone, default date, and similar governance fields. | | Organizations | Edit members | None | Selected organization + `ALL_ORG_EDIT` or `ORG_USERS_EDIT` | Organization member maintenance. | | Organizations | Generate Demo | None | UI button: selected organization + `ALL_ORG_EDIT`; actual generation: `SUPER_ADMIN` or `ADMIN` or `TRIAL` | Generate or refresh organization demo data. | | Assistants | Tenant default assistant configuration | `FEATURE_XPERT` + assistant-specific feature | `SUPER_ADMIN` | Tenant default assistant configuration. | | Assistants | Organization override assistant configuration | `FEATURE_XPERT` + assistant-specific feature | Page entry `SUPER_ADMIN` or `ADMIN`, and a selected organization | Organization-level override configuration. | | Xpert Workspace | Save workspace general settings | `FEATURE_XPERT` | `workspace.capabilities.canManage` | Not an enum permission. It is determined by workspace capabilities. | | Xpert Workspace | Members, visibility, delete, archive | `FEATURE_XPERT` | `workspace.capabilities.canManage` | Owner or tenant admin with manage capability can operate. | | Xpert authorization | Organization list scope | None | Users with `ALL_ORG_VIEW` can see all organizations; otherwise only organizations they belong to | Affects data scope, not button permission. | ## BI And Data Functions | Function / Page / Action | Required feature | Required permission / roleName | Notes | | ---------------------------------- | --------------------------------------------- | --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | View data source list | `FEATURE_MODEL` | `DATA_SOURCE_VIEW` | View data source list. | | Create / edit / delete data source | `FEATURE_MODEL` | `DATA_SOURCE_EDIT` | Data source maintenance. | | Sync data source types | None | `SUPER_ADMIN` or `ADMIN` | Sync built-in data source types. | | Semantic model entry | `FEATURE_MODEL` | `MODELS_EDIT` | `/data/models` page entry. | | Semantic model list API | `FEATURE_MODEL` | `ADMIN` | The backend model list has an administrator role restriction. | | Semantic model XMLA query | `FEATURE_MODEL` | `MODELS_VIEW` | The model must also expose XMLA and pass model viewer authorization. | | Clear semantic model cache | `FEATURE_MODEL` | `MODELS_EDIT` | Delete model cache. | | Project | `FEATURE_PROJECT` | `STORIES_EDIT` | `/data/project` entry. | | View Story | No explicit main-navigation switch | `STORIES_VIEW` | `/story` page access. | | Edit Story / Project capability | `FEATURE_PROJECT` | `STORIES_EDIT` | BI project and story editing capability. | | Business Area settings | `FEATURE_BUSINESS_AREA` | `BUSINESS_AREA_EDIT` | Business area maintenance. | | Certification settings | None | `CERTIFICATION_EDIT` + `BUSINESS_AREA_EDIT` both need attention | Entry visibility and page access currently depend on different permissions. | | Indicator App | `FEATURE_INDICATOR` + `FEATURE_INDICATOR_APP` | `INDICATOR_MARTKET_VIEW` | Indicator app entry. | | View indicators | `FEATURE_INDICATOR` | `INDICATOR_VIEW` | Indicator viewing capability. | | Edit indicators | `FEATURE_INDICATOR` | `INDICATOR_EDIT` | Indicator maintenance capability. | | Data Factory | `FEATURE_DATA_FACTORY` | `DATA_FACTORY_VIEW` / `DATA_FACTORY_EDIT` | Currently mainly permission and feature enums. Confirm concrete entry usage with the specific page. | ## AI Backend Capabilities | Function / Action | Required feature | Required permission / roleName | Notes | | ---------------------------------------- | --------------------------------------------------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------- | | Create, enable/disable, update Copilot | `FEATURE_COPILOT` | `COPILOT_EDIT` | Copilot management. | | Copilot statistics | `FEATURE_COPILOT` | `COPILOT_EDIT` | Conversation, user, message, token, and related statistics. | | Create / update Copilot Provider | `FEATURE_COPILOT` | `COPILOT_EDIT` | Model provider configuration. | | Copilot User list / renew | `FEATURE_COPILOT` | `COPILOT_EDIT` | Copilot user management. | | Knowledgebase list / statistics | `FEATURE_COPILOT_KNOWLEDGEBASE` or the feature that owns the knowledge-base entry | `KNOWLEDGEBASE_EDIT` | Knowledge base editing and statistics. | | Xpert list / select options / statistics | `FEATURE_XPERT` | `XPERT_EDIT` | Xpert management and statistics. | | Full workspace list | `FEATURE_XPERT` | `XPERT_EDIT` | Administrative workspace query. | | Read workspace | `FEATURE_XPERT` | `workspace.capabilities.canRead` | Determined by owner/member, scope, tenant-shared status, and similar factors. | | Run workspace | `FEATURE_XPERT` | `workspace.capabilities.canRun` | Determined by workspace capabilities. | | Write workspace | `FEATURE_XPERT` | `workspace.capabilities.canWrite` | Determined by workspace capabilities. | | Manage workspace | `FEATURE_XPERT` | `workspace.capabilities.canManage` | Member, visibility, delete, archive, and similar management actions. | | Agent view extension | `FEATURE_XPERT` | `XPERT_EDIT` | Agent view extension. | | Sandbox view extension | `FEATURE_XPERT` | `XPERT_EDIT` | Sandbox view extension. | | Project view extension | `FEATURE_XPERT` | `CHAT_VIEW` or `XPERT_EDIT` | Project view extension. | | Knowledgebase view extension | Knowledge-base-related feature | `KNOWLEDGEBASE_EDIT` | Knowledgebase view extension. | ## Platform Settings Capabilities | Function / Action | Required feature | Required permission / roleName | Notes | | -------------------------------------- | -------------------------- | ------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | | Add / update / delete / recover roles | `FEATURE_ROLES_PERMISSION` | `CHANGE_ROLES_PERMISSIONS` | Role maintenance. | | Enable / disable role permissions | `FEATURE_ROLES_PERMISSION` | `CHANGE_ROLES_PERMISSIONS` | Permission matrix maintenance. `SUPER_ADMIN` permissions are protected. | | Query features | None | `ALL_ORG_VIEW` | Query tenant or organization feature switches. | | Update features | None | `ALL_ORG_EDIT` | Update tenant or organization feature switches. | | Upgrade features | None | `SUPER_ADMIN` | System-level feature upgrade or backfill. | | Organization list / pagination / count | None | `ALL_ORG_VIEW` or `ALL_ORG_EDIT` | Tenant-level organization management. | | Organization details | None | Any of `ALL_ORG_VIEW` / `ALL_ORG_EDIT` / `ORG_USERS_VIEW` / `ORG_USERS_EDIT` | Also limited by current organization scope. | | User list / pagination / count | `FEATURE_USER` | `ALL_ORG_VIEW` or `ALL_ORG_EDIT` | Tenant-level user management. | | User search | `FEATURE_USER` | Any of `ORG_USERS_VIEW` / `ORG_USERS_EDIT` / `ALL_ORG_VIEW` / `ALL_ORG_EDIT` | Search scope depends on the organization context. | | User details | `FEATURE_USER` | Self; or any of `PROFILE_EDIT` / `ORG_USERS_VIEW` / `ORG_USERS_EDIT` / `ALL_ORG_VIEW` / `ALL_ORG_EDIT` | Non-self access must also pass organization-scope checks. | | Create / delete user | `FEATURE_USER` | `ALL_ORG_EDIT` | Tenant-level user maintenance. | | Update user / reset password | `FEATURE_USER` | Self can use `PROFILE_EDIT`; managing others requires `ALL_ORG_EDIT` or `SUPER_ADMIN_EDIT` | Super admin users have extra protection. | | Delete all user data | None | `ACCESS_DELETE_ALL_DATA` | High-risk operation. | | View user groups | `FEATURE_USER` | `ORG_USERS_VIEW` | User group list and details. | | Maintain user groups | `FEATURE_USER` | `ORG_USERS_EDIT` | Create, edit, maintain members, and delete. | | View invites | `FEATURE_USER` | `ORG_INVITE_VIEW` or `ORG_INVITE_EDIT` | Invite list. | | Maintain invites | `FEATURE_USER` | `ORG_INVITE_EDIT` | Create, resend, and delete invites. | | Maintain integrations | `FEATURE_INTEGRATION` | `INTEGRATION_EDIT` | System integration. | | Email templates | `FEATURE_EMAIL_TEMPLATE` | `VIEW_ALL_EMAIL_TEMPLATES` | Email template page. | | SMTP | `FEATURE_SMTP` | `CUSTOM_SMTP_VIEW` | Custom SMTP. | | Tenant settings | None | `SUPER_ADMIN` | Tenant-level settings. | | Plugins | None | `SUPER_ADMIN` or `ADMIN` or `TRIAL` | Plugin entry. | ## roleName Notes | Scenario | Meaning of roleName | Impact | | ----------------------------- | ---------------------------------------------------------------------------- | ----------------------------------------------------------------------- | | Platform role | `SUPER_ADMIN`, `ADMIN`, `AI_BUILDER`, `ANALYTICS_BUILDER`, `VIEWER`, `TRIAL` | Controls page entries, button visibility, and backend role permissions. | | User invitation | Target platform role for the invited user | Creating the invitation itself requires `ORG_INVITE_EDIT`. | | CSV bulk user import | Target platform role for imported users | The import operation itself requires `SUPER_ADMIN` or `ADMIN`. | | SSO login | Default role context during third-party login or registration | Not directly equivalent to page button permissions. | | Lark login | Default role context in the Lark configuration | Not directly equivalent to page button permissions. | | Semantic model / OLAP | Model query role or Mondrian role | This is a model access role, not a platform `RolesEnum`. | | Semantic model access control | Internal model role name | Controls model data access, not platform navigation permissions. | | Plugin user permission | Default user role used by plugins | Used in the plugin permission context. |