Access, roles and consent
Who can reach what, which consents people give, and which actions need confirmation.
Every request runs as the person asking
Copilot calls DocFlo with the signed-in person’s own DocFlo sign-in. DocFlo checks access exactly as it does in the web app: the person’s workspace, their role and the projects they belong to. There is no shared service account.
Roles
| Role | In DocFlo |
|---|---|
| Owner | Everything, including deleting the workspace and turning Copilot access on or off |
| Admin | Manage members and projects; turn Copilot access on or off |
| Developer | Build and change what the workspace runs |
| Runner | Run and ask; no building |
| Viewer | Read-only |
Project membership decides which documents a person can ask about. Every member of a project can ask about every document in it.
Consents
| Consent | Given by | Allows |
|---|---|---|
| DocFlo Allow | Each person, once | Copilot to call DocFlo on their behalf |
| OneDrive | Each person who connects one | Read-only access to their files |
| SharePoint | Tenant administrator | Read-only access to approved sites |
Actions that need confirmation
Copilot asks before DocFlo does anything that changes something:
- creating a project,
- connecting a source,
- adding files to a project,
- retrying failed files,
- stopping an answer that is still running.
Nothing can be deleted from Copilot. Documents, projects and workspaces are deleted only in the DocFlo web app, by people whose role allows it.