Chat
Chat sessions, messages and AI responses.
Chat permissions are baseline tenant-member capabilities. Personal session ownership and tenant context still apply. A permission to send a message does not grant access to someone else's history, private files, Agents or external MCP credentials.
Permissions
This family contains 7 permissions. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.
chat.message.create
Send a message or initiate a supported AI response.
Send a message or initiate a supported AI response. Model, Agent, tool and attached-content access are checked separately.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
chat.message.list
Read messages in a chat session accessible to the caller.
Read messages in a chat session accessible to the caller.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
chat.session.create
Start a chat session in the selected tenant.
Start a chat session in the selected tenant.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | chat.session.list, chat.session.read |
chat.session.delete
Delete a chat session owned by the caller.
Delete a chat session owned by the caller.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | chat.session.list, chat.session.read, chat.session.update |
chat.session.list
List the caller's chat sessions.
List the caller's chat sessions.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | chat.session.read |
chat.session.read
Read one of the caller's chat sessions.
Read one of the caller's chat sessions.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
chat.session.update
Change a chat session owned by the caller, such as its title or settings.
Change a chat session owned by the caller, such as its title or settings.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | Yes |
| Also implies | chat.session.list, chat.session.read |