Permission Manager: sets who can create, read, update and delete
Permission Manager drafts the access policy for one model. You say who should be able to create, read, update and delete its records, for example "everyone reads, managers edit, only admins delete". The agent produces a complete policy that uses the roles that exist in your workspace. It is a quick way to avoid both too much access and accidental lock-outs.
What it does
- Creates a policy for one existing model, or updates an existing one.
- Uses only real role IDs from your workspace, looked up from the role records, and never invents a role.
- Applies least privilege: it gives only the access you asked for.
- Keeps existing access unless your request clearly changes it.
- Treats an empty role list as nobody, for operations you want to switch off.
- Returns a full policy, so you can read it from top to bottom before you accept it.
When it helps
- A new HR model should be readable by HR only. You say so, and the policy lists the HR role for each operation.
- Interns should see tasks but not delete them. The agent updates the delete rule and keeps the rest.
- You inherit a model with unclear access and ask for a tight policy that only leaves editing to project leads.
How it works with your data
Permission Manager has two read tools: one lists the models, the other reads the role records. It does not apply anything. The draft appears as a preview, and the policy is only saved after you confirm it. Saving permissions is limited to people who may edit configuration, and Worknano enforces the saved policy on the server, not only in the screen. It uses a fast model. The agent works on one model at a time and does not change who holds which role. If you need a new role, create it first, then ask for the policy. Always read the draft before you confirm, because access mistakes are easy to miss.
Make it yours
Like every agent, Permission Manager is a record in the Agents module. Edit its instructions, for example to add a company rule such as "finance data is never readable by guests", switch the model, adjust the temperature or duplicate it. Permissions look and work the same in every module, which keeps reviews short. See Build your own agent and how to edit an agent.
Related: Model Editor changes the model itself, and Meta Data Assistant can route you here. More in AI agents.