# Eval Labs Roles and Access Matrix
> [!summary]
> Eval Labs is now a role-based human evaluation platform for Lucia. Clerk role metadata drives product behavior, and persisted evidence must remain protected by Supabase RLS.
---
## Role metadata
Eval Labs reads the current role from Clerk public metadata:
```json
{
"eval_labs_role": "..."
}
```
Current supported role values:
- `owner`
- `admin`
- `evaluator`
- `tester`
- missing or unassigned role
Missing, unassigned, or unknown role metadata must fail closed.
---
<div class="eval-access-matrix">
<div class="am-eyebrow"><span>Eval Labs · Roles & permissions</span></div>
<h2 class="am-title">Access matrix</h2>
<p class="am-lede">Who can do what across Eval Labs' testing, verification, and analysis surfaces. Access widens by role — from a single prompt test up to the full owner/admin workspace.</p>
<div class="am-card">
<div class="am-scroll">
<table aria-label="Eval Labs role-based access matrix">
<colgroup><col class="am-role-col" /><col /><col /><col /><col /><col /><col /><col /></colgroup>
<thead>
<tr>
<th scope="col" class="am-corner">Role</th>
<th scope="col" title="Run a one-off prompt suite you write yourself"><span class="am-num">01</span>Custom<br>Prompt Test</th>
<th scope="col" title="Run the generated 50-prompt battery"><span class="am-num">02</span>Auto-<br>generated Test</th>
<th scope="col" title="Guest-facing agent verification behavior"><span class="am-num">03</span>Verification<br>Check</th>
<th scope="col" title="Outcomes of verification runs"><span class="am-num">04</span>Verification<br>Results</th>
<th scope="col" title="Controlled platform-readiness batch runner"><span class="am-num">05</span>Controlled<br>Batch</th>
<th scope="col" title="Owner/admin oversight of evaluation work"><span class="am-num">06</span>Team<br>Review</th>
<th scope="col" title="Owner/admin platform-wide evidence analysis"><span class="am-num">07</span>Global<br>Analysis</th>
</tr>
</thead>
<tbody>
<tr class="am-tier-full">
<th scope="row" class="am-role"><span class="am-tag">owner</span><p class="am-desc">Full platform access, oversight, and final product judgment.</p><div class="am-meter"><span class="am-meter-track"><span class="am-meter-fill" style="width:100%"></span></span><span class="am-meter-label">7 / 7</span></div></th>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
</tr>
<tr class="am-tier-full">
<th scope="row" class="am-role"><span class="am-tag">admin</span><p class="am-desc">Full surface access; trusted operational oversight.</p><div class="am-meter"><span class="am-meter-track"><span class="am-meter-fill" style="width:100%"></span></span><span class="am-meter-label">7 / 7</span></div></th>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
</tr>
<tr>
<th scope="row" class="am-role"><span class="am-tag">evaluator</span><p class="am-desc">Full evaluator workbench. No Team Review or Global Analysis.</p><div class="am-meter"><span class="am-meter-track"><span class="am-meter-fill" style="width:71.4%"></span></span><span class="am-meter-label">5 / 7</span></div></th>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
</tr>
<tr>
<th scope="row" class="am-role"><span class="am-tag">tester</span><p class="am-desc">Entry-level prompt-testing lane only.</p><div class="am-meter"><span class="am-meter-track"><span class="am-meter-fill" style="width:28.6%"></span></span><span class="am-meter-label">2 / 7</span></div></th>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-mark am-grant" role="img" aria-label="Allowed"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
</tr>
<tr class="am-tier-none">
<th scope="row" class="am-role"><span class="am-tag">unassigned</span><p class="am-desc">No recognized role. Fails closed — no protected access.</p><div class="am-meter"><span class="am-meter-track"><span class="am-meter-fill" style="width:0%"></span></span><span class="am-meter-label">0 / 7</span></div></th>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
<td class="am-cell"><span class="am-deny" role="img" aria-label="Not allowed"></span></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="am-foot">
<div class="am-legend"><span class="am-item"><span class="am-mark am-grant" aria-hidden="true"><svg viewBox="0 0 16 16" fill="none"><path d="M3.5 8.5l3 3 6-7" stroke="#0A0A0A" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></span> Allowed</span><span class="am-item"><span class="am-deny" aria-hidden="true"></span> Not allowed</span></div>
<span class="am-stamp">EVALUATIONLABS.AI · ACCESS v1</span>
</div>
</div>
> [!info] Editing this grid
> The visual above is the branded Access Matrix component. To change styling or reuse it elsewhere, see [[07 - Access Matrix Component|Access Matrix Component]]. Its `publish.css` styles must ship alongside this note.
---
## Role definitions
### `owner`
Status: implemented.
Owner is the full-access platform role. Owners can use all current test surfaces, Team Review, Global Analysis, privileged diagnostics, owner/admin evidence views, and future owner tooling when it is added.
Owner access exists for platform stewardship, cross-user evidence review, release readiness, and final product judgment.
### `admin`
Status: implemented.
Admin is the privileged operational role. Admin has the same current surface access as owner for testing, evidence inspection, Team Review, Global Analysis, and platform hardening work.
Admin access exists so trusted operators can help run evaluation workflows without making every oversight task owner-only.
### `evaluator`
Status: implemented; workspace polish remains active hardening.
Evaluator is the full human evaluation workbench role. Evaluators can use evaluator-safe test types, including Custom Prompt Test, Auto-generated Prompt Test, Guest Facing Agent Verification Check, Verification Results, Controlled Batch Runner, and their own run/review/history routes.
Evaluators do not receive Team Review or Global Analysis access. Their work remains scoped to their own evaluation workflows except where owner/admin oversight applies.
### `tester`
Status: implemented as a narrower onboarding role.
Tester is the entry-level prompt-testing lane for early human evaluation cohorts. Testers can use Custom Prompt Test and Auto-generated Prompt Test.
Testers cannot use Verification Check, Verification Results, Controlled Batch Runner, Team Review, Global Analysis, Registry Diagnostics, Behavioral Observatory, or owner/admin tools.
### Unassigned or missing role
Status: implemented fail-closed posture.
An unassigned user or a user without recognized `eval_labs_role` metadata should have limited or no protected Eval Labs access.
---
## Tester vs evaluator distinction
Tester is for narrow onboarding and clean early cohort signal.
Evaluator is for the full evaluator workbench after the person is approved for broader human evaluation work.
Use tester when the assignment should stay limited to prompt testing. Use evaluator when the assignment requires verification surfaces, controlled batch workflows, and own-run history/review routes.
---
## Owner/admin oversight purpose
Team Review is the owner/admin oversight surface.
It exists to let privileged reviewers inspect evaluator activity, compare evidence quality, find review gaps, and decide whether human-evaluation signal is ready to guide product changes.
Team Review is not a tester or evaluator productivity page. It is an oversight and quality-control surface.
Global Analysis is also owner/admin-only. It is used for shared persisted evidence and platform-wide analysis, not individual evaluator onboarding.
---
## Data persistence truth
Real runs must persist to Supabase.
Owner/admin should see shared persisted Eval Labs evidence across the platform.
Evaluator and tester data remains scoped to their own work except where owner/admin oversight applies.
Saved evidence should be treated as real only when Supabase confirms persistence and the data can be reloaded from the protected store.
---
## Supabase and RLS role claim requirement
Status: implemented; active hardening continues around verification and rollout safety.
The Clerk session token must include `eval_labs_role` so Supabase RLS can recognize privileged owner/admin access.
Frontend role behavior is driven by Clerk public metadata, but persisted evidence protection depends on Supabase policies reading the same role claim from the session token.
Do not treat a local UI role check as sufficient proof of persisted evidence access. Verify the Clerk-to-Supabase claim path when changing roles, RLS policies, or privileged evidence hydration.
---
## Human onboarding posture
Eval Labs is ready for controlled human onboarding by role, not open-ended public or production maturity claims.
Use truthful status labels:
```text
implemented = present product/code path
active hardening = implemented path still being validated, polished, or tightened
deferred = intentionally outside current role/surface scope
future = planned or possible later, not current behavior
```
First human onboarding should start with the tester lane when the cohort only needs prompt testing. Evaluator onboarding should be reserved for people assigned to the full evaluator workbench.
---
## First human onboarding readiness criteria
Before onboarding a human cohort, confirm:
1. Clerk auth works for the cohort.
2. Clerk public metadata has the correct `eval_labs_role`.
3. The Clerk session token includes the role claim required by Supabase RLS.
4. The user's visible surfaces match the access matrix.
5. Real runs persist to Supabase and reload from the appropriate scoped view.
6. Owner/admin can inspect shared persisted evidence through Team Review or Global Analysis where applicable.
7. Tester assignments stay inside Custom Prompt Test and Auto-generated Prompt Test.
8. Evaluator assignments have clear guidance for verification, controlled batch, own-run review, and escalation.
9. The user understands that AI-reviewed platform readiness is not human Lucia-quality approval.
10. Any active hardening items are named before the cohort begins.
Do not describe the evaluator UX as final while onboarding/workspace polish is still active hardening.