Roles, teams and group mapping
When someone signs in with SSO, Waxell can put them on a team with a role based on their IdP groups.
Group mapping
On the provider (Settings → Identity → edit):
- Group claim: the claim or attribute that carries the user's groups.
Defaults to
groups.- Microsoft Entra SAML:
http://schemas.microsoft.com/ws/2008/06/identity/claims/groups - Okta: the claim name you configured (usually
groups)
- Microsoft Entra SAML:
- Mappings: rows of IdP group → role → team.
- IdP group: the group value exactly as the IdP sends it. Entra usually sends the group's Object ID.
- Role: a role slug, for example
viewer,developeroradmin. Saving fails if the role doesn't exist in the workspace. - Team: a team slug in this workspace.
The first mapping whose group the user has wins. On every sign-in Waxell sets that team membership to the mapped role.
Default role and team
Where someone lands when no mapping matches. Set both a role and a team, or leave both blank for no team membership.
Rules worth knowing
- A mapping takes effect only if its team exists in this workspace. A mapping with no team does nothing.
- An unknown role falls back to
viewer, the least-privileged built-in role. - Group values are split on spaces and commas, so group names with spaces
won't match. Use names like
waxell-engineering, or IDs. - Google Workspace sign-in doesn't send groups. For Google, use directory sync.
Built-in roles
| Role slug | What it can do |
|---|---|
owner | Full access to all resources and settings, including deleting the workspace and managing billing |
admin | Full access except deleting the workspace and managing billing |
developer | Manage agents, runs and API keys; view billing usage but not change plans |
agent-author | Compose and publish agents, push tools, workflows and skills, and apply catalog policies; can't delete, approve or read secrets |
viewer | Read-only access to agents, runs, policies, billing usage and audit logs |
executive | Read-only access to Insights dashboards |
billing-admin | Manage billing and view audit logs; no access to technical resources |
Workspaces can also define custom roles.
Roles and teams are managed under Settings → Roles and Settings → Teams.