Document processing

Document-processing operations, saved configurations, and access to job results.

Tenant members can run document-processing operations and read their own orchestration jobs. Saved configuration management requires tenant-administrator authority or an eligible custom-role grant. Configuration and orchestration endpoints also enforce tenant and owner scope; these operation permissions do not expose another user's saved configurations or results.

Permissions

This family contains 4 permissions, all selectable in custom roles. Baseline permissions remain available through membership even if a custom-role grant is removed.

document.configuration.read

Inspect document-processing use cases and saved configurations owned by the caller.

Inspect supported configuration use cases and list or read the caller's saved document configurations within the selected tenant.

Property	Value
Scope	Selected tenant
Granted by	Tenant administrator
Custom role	Yes

document.configuration.update

Create, replace, duplicate, or delete the caller's saved document configurations.

Manage saved document configurations in the selected tenant. Existing configurations remain owner-scoped, including when the caller is a tenant administrator.

Property	Value
Scope	Selected tenant
Granted by	Tenant administrator
Custom role	Yes
Also implies	document.configuration.read

document.job.read

Read the caller's document orchestration status and completed results.

Read orchestration status or completed results for the current tenant and caller. Another tenant's or user's run is returned as not found.

Property	Value
Scope	Selected tenant
Granted by	Baseline member
Custom role	Yes