> ## Documentation Index
> Fetch the complete documentation index at: https://neuraltrust-92b43583-develop.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles

> Roles power identity-based routing: an OIDC token's claims select a role in the console, and the role decides which registries, models, and MCP tools the caller may use.

A **role** is the routing unit for **identity-based** access. Use it with
[consumers](/trustgate/concepts/consumers) whose routing mode is **Identity-based**: instead
of the consumer owning registries directly, each request's OIDC token is matched to a role,
and the **role** decides what that caller can reach.

This lets one consumer (one endpoint) serve many identities — each user or group routed to
different models and tools — without minting a consumer per tenant.

## Create a role

1. Open **TrustGate** → **Identity** → **Roles** (or the roles section for your gateway).
2. Create a role and set a **Name**.
3. Bind the **registries** this role may use.
4. Optionally set **model policies** (allowed models + default) per registry.
5. For MCP, set **MCP policies** / toolkit grants as needed.
6. Define **OIDC mappings** — which token claims select this role (for example `groups` or
   `roles`, with equals / contains rules).
7. On the consumer, set routing mode to **Identity-based** and attach the role(s). Ensure
   the consumer has an **OIDC** (or OAuth2) credential.

## What a role defines

| Setting            | Meaning                                                               |
| ------------------ | --------------------------------------------------------------------- |
| **Name**           | Display name in the console.                                          |
| **Registries**     | Which [registries](/trustgate/concepts/registries) this role may use. |
| **Model policies** | Per-registry allow-list and default model.                            |
| **MCP policies**   | Toolkit and fail mode for agent traffic.                              |
| **OIDC mapping**   | Claim-match rules that select this role.                              |

## How selection works

1. A client calls an identity-based consumer with `Authorization: Bearer <oidc-jwt>`.
2. TrustGate validates the token (issuer, audience, JWKS, scopes).
3. Token claims are matched against each attached role's OIDC mapping.
4. The matched role's registries, model policies, and MCP policies govern that request.

See [Auth](/trustgate/concepts/auth) for Okta and Entra ID setup.