# Document processing (/docs/reference/roles-permissions/document)



Tenant members can run document-processing operations and read their own orchestration jobs. Saved configuration management requires tenant-administrator authority or an eligible custom-role grant. Configuration and orchestration endpoints also enforce tenant and owner scope; these operation permissions do not expose another user's saved configurations or results.

## Permissions [#permissions]

This family contains **4 permissions**, all selectable in custom roles. Baseline permissions remain available through membership even if a custom-role grant is removed.

<Catalogue>
  <details className="catalogue-entry">
    <summary>
      ### document.configuration.read [#documentconfigurationread]

      <span className="catalogue-description">
        Inspect document-processing use cases and saved configurations owned by the caller.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect supported configuration use cases and list or read the caller's saved document configurations within the selected tenant.

      | Property    | Value                                                                                       |
      | ----------- | ------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                             |
      | Granted by  | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role | Yes                                                                                         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### document.configuration.update [#documentconfigurationupdate]

      <span className="catalogue-description">
        Create, replace, duplicate, or delete the caller's saved document configurations.
      </span>
    </summary>

    <div className="catalogue-content">
      Manage saved document configurations in the selected tenant. Existing configurations remain owner-scoped, including when the caller is a tenant administrator.

      | Property     | Value                                                                                               |
      | ------------ | --------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                     |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator)         |
      | Custom role  | Yes                                                                                                 |
      | Also implies | [document.configuration.read](/docs/reference/roles-permissions/document#documentconfigurationread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### document.job.read [#documentjobread]

      <span className="catalogue-description">
        Read the caller's document orchestration status and completed results.
      </span>
    </summary>

    <div className="catalogue-content">
      Read orchestration status or completed results for the current tenant and caller. Another tenant's or user's run is returned as not found.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### document.processing.execute [#documentprocessingexecute]

      <span className="catalogue-description">
        Run document conversion, extraction, detection, validation, and orchestration operations.
      </span>
    </summary>

    <div className="catalogue-content">
      Run document-processing operations, including PDF conversion, rotation, extraction, detection, aggregation, validation, visualization, and orchestration. Each endpoint still validates its inputs and any referenced configuration or resource.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>
</Catalogue>

## Related pages [#related-pages]

* [Roles and permissions catalogue](/docs/reference/roles-permissions)
* [System roles and baseline access](/docs/reference/roles-permissions/system-roles)
* [Access and tenant context](/docs/use/api#tenant-selection)