Plexara
What you will take away from this lesson
A persona decides two separate things: what its people’s agent may call, and what its people may do in the portal in a browser. A contractor can be allowed to read the catalog through the agent and still be kept off the portal’s automations page, or the other way around.
The persona editor shows both on one page, grouped by surface, with a summary the server computes from the page as it stands. This lesson walks the editor section by section and ends with the checks that run before a persona is deleted.
Learning Objectives
- 01Find each persona setting in the editor by the surface it governs.
- 02Set one access level per portal area, and say which agent tool each area leaves to the tool rules.
- 03Turn sharing off for a persona and list everything that removes.
- 04Read the access summary before saving, and use it to check an external persona.
- 05Delete a persona knowing what still names it.
Where this lesson sits
Lessons 801 to 803 used the Share dialog. This lesson opens the persona editor that decides who sees Share at all, and which parts of the portal each person reaches.
800 Series: Working with People Outside the Company
- 801Who can open whatThe Share dialog by access: people and their roles, personas as groups whose membership is read when the item is opened, guests, and the one general link an item has.
- 802Requests for accessWhat a person without access sees, how the owner approves as viewer or editor or declines from the email, the Inbox or the dialog, and the limits and expiry an administrator sets.
- 803Posting to a channelPosting an item to a Slack, Mattermost or email channel as a link share of its own, what the channel sees, who the link opens for, and removing it.
- 804Portal permissionsThe persona editor by surface, one access level per portal area, the sharing permission, the access summary, and what deleting a persona checks first.
- 805Your clients as external peopleAn external persona per client organization, accounts that live in your identity provider, and the fixed limits: only what is shared, only shared threads, no sharing, no agent.
- 806Files from outsideUploads into an external person’s own folder, the External files folder staff open, and registering a client’s monthly file as a table beside the warehouse.
- 807Capstone: a supplier’s collection, thread and monthly fileAn ACME supplier collection shared with the supplier’s persona, a shared thread beside an internal one, and the supplier’s next price sheet registered and joined into the review.
The 800 series builds on sharing within the team from lesson 303 and registers a client’s file the way the 500 series does. Every example is on the ACME demo tenant, with a fictional supplier, Blue Harbor Wholesale.
The persona editor, by surface
Creating or editing a persona opens one page of sections. The index on the left jumps between them, and each section names the surface it governs.
Admin > Personas: the editor, by surface
Identity
Grants nothing
- Name, display name, roles, priority, description, and the account type: internal people, external people, or an automated caller. It warns when another persona lists one of the same roles and says which wins.
Access summary
Computed
- What the persona reaches, computed by the server from the page as it stands, saved or not, with what other objects grant it and what no persona setting governs.
Tools
AI assistant (MCP)
- The tools its people’s agent can list and call. Every row has Allow, No rule and Deny, and a deny pattern always wins. Starting points: All tools, Read only, Analyst, Clear.
Connections
AI assistant (MCP)
- The data sources a tool call reaches, and so what search, the catalog and scratch tables show.
API endpoints
AI assistant (MCP)
- The operations on each API connection that the agent may call, chosen from the connection’s own catalog.
Instructions
Grants nothing
- Tool descriptions and agent instructions for this persona, added to the platform’s text or replacing it.
Portal access
Portal (browser)
- One level per portal area, plus the sharing permission. The navigation shows only the areas a persona has, and every request to an area it lacks is refused naming the area.
An editor with unsaved changes asks before it is left, whether for another persona, through the sidebar, or by closing the tab.
One level per portal area
Portal access sets each area separately, so a persona can read knowledge pages without editing them, or use the catalog without seeing automations.
Portal access: one level per area
| Area | Levels | What it governs |
|---|---|---|
| Assets | Shared, or Own | Shared opens what others share and creates nothing; Own also creates and owns |
| Resources (files) | None, Shared, Own, Persona | From no files at all up to their own folder, their persona’s folder and the global one |
| Knowledge | None, Read, Write | Knowledge pages |
| Catalog | None, Read, Write | Browsing the catalog, or curating it |
| APIs | None, Browse | The API browser, still filtered by connections and endpoint rules |
| Scratch tables | None, List, Register | Listing registered tables, or registering over a file |
| Feedback, Prompts, Automations, Search, Memory | On or off | Each area as a whole |
| PDF export | On or off | The Export PDF action |
| Earlier versions | On or off | Whether a viewer reads an asset’s earlier versions; a new persona starts with it off |
| External files | None, View, Manage | Every external person’s own folder |
Each control’s help names the agent tool that is governed elsewhere. Turning Memory off in the portal does not take memory away from the agent, and turning Catalog to None does not stop search. Those are tool rules.
Administrators have every area, whatever their persona says.
Reading the access summary
The summary answers what a persona reaches, from the page as it stands. On the demo tenant it was run against the supplier persona built for this series.
The access summary for an external persona
Account type
external
- The supplier persona on the demo tenant, Blue Harbor Wholesale, is marked for external people.
API operations
0 callable
- Every operation on every API connection is listed with the decision external, including when the draft being checked allows every tool.
Portal areas lowered
7
- Knowledge, APIs, scratch tables, prompts, automations, search and memory are lowered by External, and the editor shows each saved choice beside what applies.
What stays as set
4
- Feedback, PDF export, earlier versions and uploads keep the values the persona sets.
The summary is recomputed as the page changes, before anything is saved. Checking a draft that asked for every tool and write access to knowledge and the catalog still came back with nothing callable, which is the quickest way to confirm what External enforces.
Deleting a persona
Permissions, end to end
Tool rules govern the agent, portal levels govern the browser, the sharing permission governs every way of opening an item to someone else, and the access summary shows the result before it is saved.
Key terms
Three terms cover portal permissions.
Key Terms
- Portal access
- The persona editor section that sets one level per portal area. It governs the browser, not the agent.
- Sharing permission
- The Sharing checkbox. Cleared, the persona’s people cannot share anything, post to a channel, or approve an access request.
- Access summary
- What a persona reaches, computed by the server from the editor as it stands, saved or not.