Backend user permissions 

Assigning grants 

Grants are ordinary TYPO3 custom permission options. In the backend group record (Module permissions tab, section AI (nr_llm) permissions), tick the grants the group should hold. Notes:

• Grants are group-scoped — a backend user without groups cannot hold a grant.
• Administrators hold every grant implicitly.
• Revoking a grant takes effect with the user's next request.

Available grants 

Execute AI tasks (tasks_use)

Run existing AI tasks and refresh their input data. What a task may read and which model and configuration it uses is defined by whoever manages the task — that is the trust boundary: task managers define, grant holders execute. Every run is pre-flighted against the user's own usage budget and attributed to them. The grant also shows the user their own usage against that budget and the cost estimate of a run (Usage, budget and cost estimate).

Since ADR-158 the same grant opens the Editor Action Center in that module. It does not decide which actions appear there: that is the tool gate's answer plus access to the default LLM configuration — a user outside its Allowed backend groups is offered nothing and can start nothing — and every writing tool is disabled until an administrator enables it. Starting an action always suspends for approval before anything is written.

Approve suspended AI runs (agent_approve)

Approve, deny or answer agent runs suspended for a human decision — including runs started by other users. Without this grant a user can only ever decide their own runs. Deliberately part of no recommended preset: granting it is an explicit trust decision.

See the AI usage of assigned groups (usage_view_groups)

See the AI usage and estimated cost of every member of the backend groups selected in the group record's AI usage visible for groups field, in the module AI > AI usage of my groups (ADR-277). Without an assignment the grant shows nobody. Who counts as a member, and what is never shown, is described in AI usage of assigned groups.

Warning

This grant makes personal data of other users visible to a non-administrator. Clear it with your works council and your data protection officer before you grant it (Before you switch it on: personal data). Part of no preset.

Recommended presets 

Roles are named grant bundles, not code:

Approval (agent_approve) sits in no preset — add it deliberately where the organisation wants non-admin approvers. The same holds for usage_view_groups: add it only for head editors, together with an assignment.

Current reach 

Grant holders work in the dedicated AI Tasks module under the AI group (ADR-131). Reaching it takes BOTH switches: the module must be ticked in the group's module list (access => user) AND the grant must be held — the module switch alone never grants execution. Tasks with the table input type are not offered to editors (their record picker has no read boundary yet and stays admin-only).

Holders of usage_view_groups use the module AI usage of my groups under the same AI group, with the same two switches: the module ticked in the group's module list AND the grant held.

Everything else — configuration, providers, models, the playground, record browsing, the Analytics module with its billing report and export — remains administrator-only regardless of grants.