Skip to main content
A role is the routing unit for identity-based access. Use it with consumers whose routing mode is Identity-based: instead of the consumer owning registries directly, each request’s OIDC token is matched to a role, and the role decides what that caller can reach. This lets one consumer (one endpoint) serve many identities — each user or group routed to different models and tools — without minting a consumer per tenant.

​
Create a role

  1. Open TrustGate → Identity → Roles (or the roles section for your gateway).
  2. Create a role and set a Name.
  3. Bind the registries this role may use.
  4. Optionally set model policies (allowed models + default) per registry.
  5. For MCP, set MCP policies / toolkit grants as needed.
  6. Define OIDC mappings — which token claims select this role (for example groups or roles, with equals / contains rules).
  7. On the consumer, set routing mode to Identity-based and attach the role(s). Ensure the consumer has an OIDC (or OAuth2) credential.

​
What a role defines

​
How selection works

  1. A client calls an identity-based consumer with Authorization: Bearer <oidc-jwt>.
  2. TrustGate validates the token (issuer, audience, JWKS, scopes).
  3. Token claims are matched against each attached role’s OIDC mapping.
  4. The matched role’s registries, model policies, and MCP policies govern that request.
See Auth for Okta and Entra ID setup.