Document AI roles and permissions

This page lists the IAM roles and permissions for Document AI. To search through all roles and permissions, see the role and permission index.

Document AI roles

Role Permissions

Role	Permissions
Document AI Administrator ^Beta (`roles/documentai.admin`) Grants full access to all resources in Document AI	`documentai.*` `documentai.dataLabelingJobs.cancel` `documentai.dataLabelingJobs.create` `documentai.dataLabelingJobs.list` `documentai.datasetSchemas.get` `documentai.datasetSchemas.update` `documentai.datasets.createDocuments` `documentai.datasets.deleteDocuments` `documentai.datasets.get` `documentai.datasets.getDocuments` `documentai.datasets.listDocuments` `documentai.datasets.update` `documentai.datasets.updateDocuments` `documentai.evaluationDocuments.get` `documentai.evaluations.create` `documentai.evaluations.get` `documentai.evaluations.list` `documentai.humanReviewConfigs.get` `documentai.humanReviewConfigs.review` `documentai.humanReviewConfigs.update` `documentai.labelerPools.create` `documentai.labelerPools.delete` `documentai.labelerPools.get` `documentai.labelerPools.list` `documentai.locations.get` `documentai.locations.list` `documentai.operations.getLegacy` `documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments` `documentai.processorTypes.get` `documentai.processorTypes.list` `documentai.processorVersions.create` `documentai.processorVersions.delete` `documentai.processorVersions.get` `documentai.processorVersions.list` `documentai.processorVersions.processBatch` `documentai.processorVersions.processOnline` `documentai.processorVersions.update` `documentai.processors.create` `documentai.processors.delete` `documentai.processors.fetchHumanReviewDetails` `documentai.processors.get` `documentai.processors.list` `documentai.processors.processBatch` `documentai.processors.processOnline` `documentai.processors.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Document AI API User ^Beta (`roles/documentai.apiUser`) Grants access to process documents in Document AI	`documentai.humanReviewConfigs.review` `documentai.operations.getLegacy` `documentai.processorVersions.processBatch` `documentai.processorVersions.processOnline` `documentai.processors.processBatch` `documentai.processors.processOnline`
Document AI Editor ^Beta (`roles/documentai.editor`) Grants access to use all resources in Document AI	`documentai.*` `documentai.dataLabelingJobs.cancel` `documentai.dataLabelingJobs.create` `documentai.dataLabelingJobs.list` `documentai.datasetSchemas.get` `documentai.datasetSchemas.update` `documentai.datasets.createDocuments` `documentai.datasets.deleteDocuments` `documentai.datasets.get` `documentai.datasets.getDocuments` `documentai.datasets.listDocuments` `documentai.datasets.update` `documentai.datasets.updateDocuments` `documentai.evaluationDocuments.get` `documentai.evaluations.create` `documentai.evaluations.get` `documentai.evaluations.list` `documentai.humanReviewConfigs.get` `documentai.humanReviewConfigs.review` `documentai.humanReviewConfigs.update` `documentai.labelerPools.create` `documentai.labelerPools.delete` `documentai.labelerPools.get` `documentai.labelerPools.list` `documentai.locations.get` `documentai.locations.list` `documentai.operations.getLegacy` `documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments` `documentai.processorTypes.get` `documentai.processorTypes.list` `documentai.processorVersions.create` `documentai.processorVersions.delete` `documentai.processorVersions.get` `documentai.processorVersions.list` `documentai.processorVersions.processBatch` `documentai.processorVersions.processOnline` `documentai.processorVersions.update` `documentai.processors.create` `documentai.processors.delete` `documentai.processors.fetchHumanReviewDetails` `documentai.processors.get` `documentai.processors.list` `documentai.processors.processBatch` `documentai.processors.processOnline` `documentai.processors.update` `resourcemanager.projects.get` `resourcemanager.projects.list`
Document AI Viewer ^Beta (`roles/documentai.viewer`) Grants access to view all resources and process documents in Document AI	`documentai.dataLabelingJobs.list` `documentai.datasetSchemas.get` `documentai.datasets.get` `documentai.datasets.getDocuments` `documentai.datasets.listDocuments` `documentai.evaluationDocuments.get` `documentai.evaluations.get` `documentai.evaluations.list` `documentai.humanReviewConfigs.get` `documentai.humanReviewConfigs.review` `documentai.labelerPools.get` `documentai.labelerPools.list` `documentai.locations.` `documentai.locations.get` `documentai.locations.list` `documentai.operations.getLegacy` `documentai.processedDocumentsSets.` `documentai.processedDocumentsSets.get` `documentai.processedDocumentsSets.getDocuments` `documentai.processedDocumentsSets.listDocuments` `documentai.processorTypes.*` `documentai.processorTypes.get` `documentai.processorTypes.list` `documentai.processorVersions.get` `documentai.processorVersions.list` `documentai.processorVersions.processBatch` `documentai.processorVersions.processOnline` `documentai.processors.fetchHumanReviewDetails` `documentai.processors.get` `documentai.processors.list` `documentai.processors.processBatch` `documentai.processors.processOnline` `resourcemanager.projects.get` `resourcemanager.projects.list`
DocumentAI Core Service Agent (`roles/documentaicore.serviceAgent`) Gives DocumentAI Core Service Account access to consumer resources. Warning: Do not grant service agent roles to any principals except service agents.	`automl.models.predict` `documentai.humanReviewConfigs.review` `storage.buckets.get` `storage.objects.create` `storage.objects.delete` `storage.objects.get` `storage.objects.list` `storage.objects.update`

Document AI Administrator ^Beta

(roles/documentai.admin)

Grants full access to all resources in Document AI

documentai.*

documentai.dataLabelingJobs.cancel
documentai.dataLabelingJobs.create
documentai.dataLabelingJobs.list
documentai.datasetSchemas.get
documentai.datasetSchemas.update
documentai.datasets.createDocuments
documentai.datasets.deleteDocuments
documentai.datasets.get
documentai.datasets.getDocuments
documentai.datasets.listDocuments
documentai.datasets.update
documentai.datasets.updateDocuments
documentai.evaluationDocuments.get
documentai.evaluations.create
documentai.evaluations.get
documentai.evaluations.list
documentai.humanReviewConfigs.get
documentai.humanReviewConfigs.review
documentai.humanReviewConfigs.update
documentai.labelerPools.create
documentai.labelerPools.delete
documentai.labelerPools.get
documentai.labelerPools.list
documentai.locations.get
documentai.locations.list
documentai.operations.getLegacy
documentai.processedDocumentsSets.get
documentai.processedDocumentsSets.getDocuments
documentai.processedDocumentsSets.listDocuments
documentai.processorTypes.get
documentai.processorTypes.list
documentai.processorVersions.create
documentai.processorVersions.delete
documentai.processorVersions.get
documentai.processorVersions.list
documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
documentai.processorVersions.update
documentai.processors.create
documentai.processors.delete
documentai.processors.fetchHumanReviewDetails
documentai.processors.get
documentai.processors.list
documentai.processors.processBatch
documentai.processors.processOnline
documentai.processors.update

resourcemanager.projects.get

resourcemanager.projects.list

Document AI API User ^Beta

(roles/documentai.apiUser)

Grants access to process documents in Document AI

documentai.humanReviewConfigs.review

documentai.operations.getLegacy

documentai.processorVersions.processBatch

documentai.processorVersions.processOnline

documentai.processors.processBatch

documentai.processors.processOnline

Document AI Editor ^Beta

(roles/documentai.editor)

Grants access to use all resources in Document AI

documentai.*

documentai.dataLabelingJobs.cancel
documentai.dataLabelingJobs.create
documentai.dataLabelingJobs.list
documentai.datasetSchemas.get
documentai.datasetSchemas.update
documentai.datasets.createDocuments
documentai.datasets.deleteDocuments
documentai.datasets.get
documentai.datasets.getDocuments
documentai.datasets.listDocuments
documentai.datasets.update
documentai.datasets.updateDocuments
documentai.evaluationDocuments.get
documentai.evaluations.create
documentai.evaluations.get
documentai.evaluations.list
documentai.humanReviewConfigs.get
documentai.humanReviewConfigs.review
documentai.humanReviewConfigs.update
documentai.labelerPools.create
documentai.labelerPools.delete
documentai.labelerPools.get
documentai.labelerPools.list
documentai.locations.get
documentai.locations.list
documentai.operations.getLegacy
documentai.processedDocumentsSets.get
documentai.processedDocumentsSets.getDocuments
documentai.processedDocumentsSets.listDocuments
documentai.processorTypes.get
documentai.processorTypes.list
documentai.processorVersions.create
documentai.processorVersions.delete
documentai.processorVersions.get
documentai.processorVersions.list
documentai.processorVersions.processBatch
documentai.processorVersions.processOnline
documentai.processorVersions.update
documentai.processors.create
documentai.processors.delete
documentai.processors.fetchHumanReviewDetails
documentai.processors.get
documentai.processors.list
documentai.processors.processBatch
documentai.processors.processOnline
documentai.processors.update

resourcemanager.projects.get

resourcemanager.projects.list

Document AI Viewer ^Beta

(roles/documentai.viewer)

Grants access to view all resources and process documents in Document AI

documentai.dataLabelingJobs.list

documentai.datasetSchemas.get

documentai.datasets.get

documentai.datasets.getDocuments

documentai.datasets.listDocuments

documentai.evaluationDocuments.get

documentai.evaluations.get

documentai.evaluations.list

documentai.humanReviewConfigs.get

documentai.humanReviewConfigs.review

documentai.labelerPools.get

documentai.labelerPools.list

documentai.locations.*

documentai.locations.get
documentai.locations.list

documentai.operations.getLegacy

documentai.processedDocumentsSets.*

documentai.processedDocumentsSets.get
documentai.processedDocumentsSets.getDocuments
documentai.processedDocumentsSets.listDocuments

documentai.processorTypes.*

documentai.processorTypes.get
documentai.processorTypes.list

documentai.processorVersions.get

documentai.processorVersions.list

documentai.processorVersions.processBatch

documentai.processorVersions.processOnline

documentai.processors.fetchHumanReviewDetails

documentai.processors.get

documentai.processors.list

documentai.processors.processBatch

documentai.processors.processOnline

resourcemanager.projects.get

resourcemanager.projects.list

DocumentAI Core Service Agent

(roles/documentaicore.serviceAgent)

Gives DocumentAI Core Service Account access to consumer resources.

automl.models.predict

documentai.humanReviewConfigs.review

storage.buckets.get

storage.objects.create

storage.objects.delete

storage.objects.get

storage.objects.list

storage.objects.update

Document AI permissions

Permission	Included in roles
`documentai.dataLabelingJobs.cancel`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.dataLabelingJobs.create`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.dataLabelingJobs.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`)
`documentai.datasetSchemas.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.datasetSchemas.update`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.datasets.createDocuments`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Content Warehouse Service Agent (`roles/contentwarehouse.serviceAgent`)
`documentai.datasets.deleteDocuments`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.datasets.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.datasets.getDocuments`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.datasets.listDocuments`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.datasets.update`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.datasets.updateDocuments`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.evaluationDocuments.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.evaluations.create`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.evaluations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.evaluations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`)
`documentai.humanReviewConfigs.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.humanReviewConfigs.review`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI API User (`roles/documentai.apiUser`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. DocumentAI Core Service Agent (`roles/documentaicore.serviceAgent`)
`documentai.humanReviewConfigs.update`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.labelerPools.create`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.labelerPools.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.labelerPools.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.labelerPools.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`)
`documentai.locations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.locations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`)
`documentai.operations.getLegacy`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI API User (`roles/documentai.apiUser`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.processedDocumentsSets.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.processedDocumentsSets.getDocuments`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.processedDocumentsSets.listDocuments`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.processorTypes.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.processorTypes.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`)
`documentai.processorVersions.create`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.processorVersions.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.processorVersions.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.processorVersions.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`)
`documentai.processorVersions.processBatch`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI API User (`roles/documentai.apiUser`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.processorVersions.processOnline`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI API User (`roles/documentai.apiUser`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Vertex AI RAG Data Service Agent (`roles/aiplatform.ragServiceAgent`)
`documentai.processorVersions.update`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.processors.create`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.processors.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)
`documentai.processors.fetchHumanReviewDetails`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`)
`documentai.processors.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Content Warehouse Service Agent (`roles/contentwarehouse.serviceAgent`) Vertex AI RAG Data Service Agent (`roles/aiplatform.ragServiceAgent`)
`documentai.processors.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`)
`documentai.processors.processBatch`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI API User (`roles/documentai.apiUser`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Content Warehouse Service Agent (`roles/contentwarehouse.serviceAgent`)
`documentai.processors.processOnline`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Document AI Administrator (`roles/documentai.admin`) Document AI API User (`roles/documentai.apiUser`) Document AI Editor (`roles/documentai.editor`) Document AI Viewer (`roles/documentai.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Vertex AI RAG Data Service Agent (`roles/aiplatform.ragServiceAgent`)
`documentai.processors.update`	Owner (`roles/owner`) Editor (`roles/editor`) Document AI Administrator (`roles/documentai.admin`) Document AI Editor (`roles/documentai.editor`)

Document AI roles and permissions Stay organized with collections Save and categorize content based on your preferences.