Access to the assistant is layered. A user must clear three checks before any tool runs.
The two roles
| Role | Who it is for | What it grants |
|---|---|---|
| Assistant User | Everyday staff who ask the assistant questions | Permission to use assistant tools and to view their own connection history. |
| Assistant Admin | Administrators who configure the gateway | Full access to gateway configuration and management, plus visibility of all audit logs. The System Manager role carries the same administrative rights. |
The three checks before a tool runs
Every assistant request passes through these gates in order. If any one fails, the request is refused and the refusal is logged.
Does the user have access to the assistant? The user must hold one of the assistant roles and have the Enable Assistant Access checkbox ticked on their user record. This checkbox is on by default for users who hold an assistant role.
Is the tool enabled and allowed for this user? The capability pack must be on, the individual tool must be enabled, and, if the tool restricts access by role, the user must hold one of the listed roles.
Does the user have permission for the data? The tool runs under the user's own permissions. If the user cannot read or change a given document type directly in iVendNext, they cannot do it through the assistant either.
The golden rule of access
The assistant never grants new privileges. It is a faster way to do what a user is already allowed to do. A sales clerk asking for the company's full payroll will get nothing back, because their account cannot see payroll in the first place.
Enabling a user, step by step
Open the user's record in iVendNext.
Assign the Assistant User role (or Assistant Admin for administrators).
Confirm the Enable Assistant Access checkbox is ticked.
Save. The user can now connect an AI assistant.