Overview
F5 Workforce AI Security uses admin users to control who can configure it. Directory synchronization imports end users automatically. You add admin users manually instead. You then assign each admin user a role. The role sets what the admin user can access and configure. This includes policies, user activity, and settings.
Workforce AI Security uses a role-based access control model with three admin roles: Owner, Admin, and Auditor.
You can also control specific permissions for each admin user in Workforce AI Security. These permissions cover access to capabilities beyond an admin user's base role. Examples include viewing user prompts and conversation history. Access can vary between two admins with the same role, depending on your privacy requirements.
Admin roles
Workforce AI Security has three admin roles that determine what actions an admin user can perform:
Owner: Has unrestricted access to all Workforce AI Security capabilities. This includes policy configuration, network integration, user and group management, and admin user management. Owners are the only role that can assign or modify admin roles for other users. Owners can also view all audit logs and analytics.
Admin: Configures Workforce AI Security like an Owner. This role can't view, add, modify, or delete admin users. It fits admins handling day-to-day configuration. They don't need to manage other admin users.
Auditor: Views Workforce AI Security configuration but can't make changes. Auditors can't view the Admin Users page or see who has admin access. This role fits compliance teams and stakeholders who need visibility into configuration and usage.
A user can have only one admin role at a time. Role changes take effect immediately when you save them. After F5 provisions your tenant, you log in as the initial Owner. You authenticate using Magic Link. Your first task is to add the admin users your organization needs.
Admin permissions
Workforce AI Security also provides granular permissions. You can enable or disable each one for individual admin users. These permissions control access to sensitive capabilities beyond an admin user's base role.
View User Event Conversation History
The View User Event Conversation History permission controls access to prompt and response content. This content lives in User Activity logs. When enabled, an admin user can click any event to see the full conversation. This includes what the user asked and the response from the model.
When disabled, the admin user still sees that an event occurred. They also see metadata such as user identity, timestamp, service accessed, and risk classification. They can't view the prompt content or conversation details.
Organizations with strict privacy or regulatory requirements can use this permission. It controls who accesses user-generated content. For example, grant it to security investigators who review policy violations in detail. Disable it for admins who only monitor overall health.
The permission applies independently to all three roles. Owners, Admins, and Auditors can each have it enabled or disabled. The choice depends on their responsibilities.
Workforce AI Security enables this permission by default for new admin users. If you have the Owner role, you can toggle it on or off at any time.
Create an admin user
You add admin users manually in the Workforce AI Security admin interface. You can't assign admin access by group membership or import it through directory synchronization. To create an admin user, log in as a user with the Owner role:
Browse to the Workforce AI Security admin interface and log in with your credentials.
Click Users & Groups in the CONFIGURE section, then click Admin Users.
This page lists all existing admin users in a table. The table shows their name, email address, and assigned role.
Click ADD ADMIN USER in the upper right corner of the page.
A fly-out panel opens on the right side of the screen.
Enter the user's full name in the Name field.
This is typically the user's first and last name as it appears in your directory.
Enter the user's email address in the Email field.
Workforce AI Security uses this address for authentication. It must be an email the user can access.
Select the user's role from the Role drop-down menu.
Choose Owner, Admin, or Auditor based on the user's responsibilities and access requirements.
Configure the Permissions section based on the user's role and your privacy requirements. Click the toggle to enable or disable the View User Event Conversation History permission. When enabled, the admin user can see full user prompts and model responses in User Activity. When disabled, they can still see event metadata but can't view conversation content.
Click SAVE to create the admin user.
After you save, the new admin user gets an email with instructions to log in. The email links to the Workforce AI Security admin interface. The user authenticates with the email address you provided. They get access based on their assigned role and permissions. You can modify a user's role or permissions at any time. See Modify or delete an admin user.
Modify or delete an admin user
You need the Owner role to modify an admin user's role or permissions. Log in as a user with that role. With the Owner role, you can also remove admin access entirely. Changes to admin users take effect immediately when you save them:
Browse to the Workforce AI Security admin interface and log in with your credentials.
Click Users & Groups in the CONFIGURE section, then click Admin Users.
Click the arrow icon next to the admin user you want to modify.
A fly-out panel opens showing the user's current name, email, role, and permissions.
Select a different option from the Role drop-down menu to change the user's role.
Toggle the View User Event Conversation History permission on or off to change the user's permissions.
Click SAVE to apply the changes.
Click Delete at the top of the fly-out panel to remove the admin user.
This permanently removes the user's admin access to Workforce AI Security.
The user can no longer log in to the Workforce AI Security admin interface.
You can't undo this action, but you can re-add the user later.
When you delete an admin user, keep at least one user with the Owner role. Without an Owner, no one can manage admin users. To remove the only Owner, first promote another user to the Owner role. Then delete the original Owner.