Users and roles

Each person in your organization gets into Zoan Cloud with three things that are decided separately:

	What it decides	Where
Roles	What they can do: view, run, design, approve, administer.	Administración › Usuarios (Administration › Users)
Licenses	Whether they can design in the Designer or run robots from their own computer.	Administración › Usuarios
Access	Which environments and folders they work in.	Administración › Usuarios and each folder’s Acceso (Access) tab

Keeping them apart lets you give each person exactly what their work needs: a collections analyst can approve tasks and follow her robots without a development license, and a developer can design without getting into other areas’ folders.

System roles

Role	For whom	What they can do
Propietario (Owner)	The account owner	Everything, across the organization, including billing and subscription.
Administrador (Administrator)	Whoever runs operations	People, roles, settings and every environment with every permission. Does not manage billing.
Desarrollador (Developer)	Whoever builds automations	Designs, publishes and maintains processes; manages their credentials and triggers.
Operador (Operator)	Whoever runs day-to-day	Runs and monitors processes in production, without changing their configuration.
Auditor	Compliance and internal control	Read access to every resource, plus the audit log.
Lector (Viewer)	Observers	Read access to operations: environments, processes and executions.
Diseñador de IA (AI designer)	Whoever builds assistants and document extraction	Designs, publishes and maintains AI assistants and extraction projects, with their credentials and connections. Does not touch robots or processes.
Asesor de atención (Support agent)	Whoever serves customers	Handles conversations escalated by assistants and human tasks, without changing configuration.

Owner and Administrator get into every environment, including those created later.

Roles add up

A person can have several roles, and their permissions are the sum of all of them. Roles belong to the organization: they apply the same in every environment and folder the person gets into. Assign the narrowest ones that let them do their job.

Your organization’s roles

Under Administración › Roles (Roles y permisos, Roles and permissions) you can create your own roles with the permissions you choose, for example Contabilidad (Accounting), if your plan includes custom roles. They add to the person’s other roles and also serve to route tasks: a task addressed to the Accounting role is only seen and decided by its members. To split work across teams without multiplying roles, use groups: the role grants the permissions and the group says who gets each task. Exportar matriz (Export matrix) downloads a CSV of which permissions each role has.

Nobody can grant a role with permissions they don’t have, or manage someone who has a role they could not grant. The organization always keeps at least one Owner.

Licenses

Licenses say what each person can do according to their work. They are separate from roles: changing someone’s roles doesn’t change their licenses.

License	What it enables
Desarrollo (Development)	Create and publish robots, assistants, document extraction, flows and forms, and work in the Zoan Designer.
Robot atendido (Attended robot)	Run robots from their own computer with Zoan Agent, in their own name.

• Handling tasks, filling in forms and browsing the portal depend only on roles: they need no license.
• Each assigned license uses a seat from your plan. The screen shows how many are in use (for example, «3 de 5 en uso», 3 of 5 in use). To give one more when seats are full, free one up or upgrade your plan.
• Someone who is not an Owner or Administrator can only assign the licenses they have, and nobody changes their own.

If someone’s roles let them create or publish but they lack the development license, the form warns you so you can check it.

Inviting a person

1. Under Administración › Usuarios, click Invitar (Invite).
2. Type their Correo (Email) and, optionally, their name.
3. Roles: move the ones they need to Asignados (Assigned).
4. Licencias (Licenses): check the ones their work requires.
5. Ambientes (Environments): pick where they will work. Picking an environment only lets them in; there they work with their roles. Check Todas las carpetas (All folders) if they should also see what is inside folders; otherwise they get into the folders you assign them to.
6. Review Qué podrá hacer (What they will be able to do) and click Enviar invitación (Send invitation).

They get an email to set their password and sign in. If your organization uses single sign-on (SSO), see Organization and SSO.

Changing roles, licenses or access

Open the person under Administración › Usuarios and change their roles, licenses or environments in their Acceso (Access); save with Guardar acceso (Save access). Entry to each folder is managed in the Center, on the folder’s Acceso tab. See Folders and access.

People managed by Microsoft Entra ID

If your organization creates accounts from Microsoft Entra ID, those people show Gestionado por Microsoft Entra (managed by Microsoft Entra): they sign in with their Microsoft account, their name and email come from Entra, and roles, licenses or environments a group gives them are marked De Microsoft Entra (removed in Entra or in the group, not here). What you add by hand is always kept.

When one of them leaves the synced groups or is disabled in Entra, they show as Suspendido (suspended): they can’t sign in or get new work, but nothing is deleted. Reactivar (reactivate) gives their access back (if they’re still out of the groups, the next sync suspends them again).

Deleting a person

When you delete someone, their access is revoked immediately and their license is freed. Their history and the executions they launched are kept, so traceability is not lost.

Good practices

• Least privilege: start with the narrowest role and widen only if needed.
• Few owners: the Owner controls billing and security.
• Whoever designs is not whoever operates: separating who publishes from who runs reduces errors in production.
• Folders per area: grant access per folder instead of Todas las carpetas when one area’s work doesn’t concern another.
• Review periodically the list of people and free licenses no longer in use.

Zoan Automation support

There is an internal role reserved for Zoan Automation support staff. Organizations cannot assign it and it doesn’t appear in your role list.

Next steps

• Folders and access — who gets into each area.
• Environments — separate production from testing.
• Tasks — route decisions to people, roles or groups.
• Groups, recipients and substitutes — teams, owners and who covers whom.