document-understanding
latest
false
UiPath logo, featuring letters U and I in white

Document Understanding Modern Projects User Guide

Last updated Sep 8, 2025

Role-based access control

This section is primarily intended to guide administrators in configuring and managing access control based on user roles for Document UnderstandingTM.

User roles

Document UnderstandingTM has the following default roles and permissions:
  • DU Administrator: acts as a service-level administrator who has permission to perform any action within Document Understanding.
    Note: DU Administrators can only assign roles if they also hold the position of Organization Administrator. This can occur in two scenarios:
    • If the DU Administrator role was inherited as part of the Administrator group at Organization level, it works as expected. Any user part of the Administrator group in Automation CloudTM is automatically an Organization Administrator.
    • If the DU Administrator role was explicitly assigned (for example, to a user that is part of the Everyone group in Automation CloudTM), the user can perform all tasks in Document Understanding as defined by the DU Administrator role, except Role Assignments.
  • DU Data Annotator: has permission to view projects and annotate documents, or edit fields, but can't delete data from document types or publish project versions.
  • DU Developer: acts as a project-level administrator who has permission to perform any action within a project.
  • DU Model Trainer: has permission to modify certain document type settings and delete or upload documents.
  • DU Viewer: has permissions to view certain features, but can't modify any settings within a project.

Custom roles

Custom service roles are user-defined permission sets that allow you to tailor access controls to your specific needs, offering more granular control than default roles.

To create custom roles at service level, navigate to Manage access at Document Understanding level, and select Create role from the Roles tab to define roles, and select your preferred scope and permissions.



Inheritance of organization roles

Organization roles are automatically mapped to Document Understanding roles.

Table 1. Organization roles inheritance
Tenant roleDocument Understanding role
AdministratorsDU Administrator
Automation DevelopersDU Developer
Automation UsersDU Viewer

Organization Administrators are automatically granted DU Administrator privileges. This applies to all other roles mentioned in the previous table. However, you can't currently remove or delete automatically assigned roles. For instance, if you want only a specific subset of organization admins to have DU Administrator privileges, this feature is not available at this time. You can explicitly assign the DU Administrator role to a user outside of the Administrator group, but they will not have access to manage role assignments.

Managing and assigning roles

To manage overall access and roles for Document Understanding, select the Manage access button at the top-right of the screen.

Figure 1. Document Understanding manage access

To manage access for a specific project, open that project and go to the Manage access section at the bottom-left of the screen.

Figure 2. Project manage access

User roles and permissions

Setting up different roles, assigning specific access rights, and managing users ensure that each user within your organization has the type of access suited to their professional requirements, upholding data integrity and enhancing system security.

On the Manage Access page you can see four types of roles with their appropriate permissions:
  • Document Understanding Administrator: administrator, has all permissions.
  • Document Understanding Data Annotator: can view projects, label documents, edit fields, but can't delete data from Document Types or publish project versions.
  • Document Understanding Developer: can read projects and can manage anything inside a project: classifiers, extractors, document types. Cannot create or delete projects.
  • Document Understanding Model Trainer: can view projects, label documents, edit fields, import or export data and delete data from a Document Type session.
  • Document Understanding Viewer: can view all entities but has no rights to edit or delete them.
  • Project Administrator: has all permissions to manage a project and users for the project.
    Note: This role is only available at project level.

Document Understanding Administrator permissions

Permission

Description

Classifier.CreateYou can create a new classifier.
Classifier.DeleteYou can delete an already available classifier.
Classifier.ReadYou can read the classifier.
Classifier.UpdateYou can update a classifier that is already available.
DataSetExport.Create

You can export a dataset from a project version and manage the visibility of the Download document(s) button.

DataSetExport.DeleteYou can delete a dataset export.
DataSetExport.ReadYou can read an available dataset export.
Documents.DeleteYou can delete documents.
DocumentType.CreateYou can create new document types.
DocumentType.DeleteYou can delete entire document types (including documents, annotations, schemas, etc.)
DocumentType.ReadYou can read an already available Document Type.
DocumentType.UpdateYou can update a document type that is already available. You can update anything inside a particular document type (for example, add or remove documents, add or remove annotations, add or remove fields, and others).
Extractor.CreateYou can create a new extractor.
Extractor.DeleteYou can delete an already available extractor.
Extractor.ReadYou can read the extractor.
Extractor.UpdateYou can update an extractor that is already available.
MonitorProcessedDocuments.ReadYou can read the processed documents from the Monitor section.
MonitorProcessedDocumentsDetail.ReadYou can read the processed documents detail from the Monitor section.
MonitorProjectPerformance.ReadYou can read the Projects Performance dashboard from the Monitor section.
Project.CreateUser can create new projects.
Project.DeleteYou can delete an already available project.
Project.ReadYou can read the project.
Project.UpdateYou can update an already available project.
ProjectVersion.CreateYou can create new project versions.
ProjectVersion.DeleteYou can delete an already available project version.
ProjectVersion.ReadYou can read a project version.
ProjectVersion.UpdateYou can update an already available project version.
ProjectVersionLabel.CreateYou can create new project version labels.
ProjectVersionLabel.DeleteYou can delete an already available project version label.
ProjectVersionLabel.ReadYou can read a project version label.
ProjectVersionLabel.UpdateYou can update an already available project version label.
TenantSettings.CreateYou can create Document Understanding tenant level settings.
TenantSettings.ReadYou can read Document Understanding tenant level settings.
TenantSettings.UpdateYou can update Document Understanding tenant level settings.

Document Understanding Data Annotator permissions

Permission

Description

Classifier.ReadYou can read the classifier.
DocumentType.ReadYou can read an already available Document Type.
DocumentType.UpdateYou can update a document type that is already available. You can update anything inside a particular document type (for example, add or remove documents, add or remove annotations, add or remove fields, and others).
Extractor.ReadYou can read the extractor.
MonitorProcessedDocuments.ReadYou can read the processed documents from the Monitor section.
MonitorProcessedDocumentsDetail.ReadYou can read the processed documents detail from the Monitor section.
MonitorProjectPerformance.ReadYou can read the Projects Performance dashboard from the Monitor section.
Project.ReadYou can read the project.
ProjectVersion.ReadYou can read a project version.
ProjectVersionLabel.ReadYou can read a project version label.

Document Understanding Developer permissions

Permission

Description

Classifier.CreateYou can create a new classifier.
Classifier.DeleteYou can delete an already available classifier.
Classifier.ReadYou can read the classifier.
Classifier.UpdateYou can update a classifier that is already available.
DataSetExport.Create

You can export a dataset from a project version and manage the visibility of the Download document(s) button.

DataSetExport.DeleteYou can delete a dataset export.
DataSetExport.ReadYou can read an available dataset export.
Documents.DeleteYou can delete documents.
DocumentType.CreateYou can create new document types.
DocumentType.DeleteYou can delete entire document types (including documents, annotations, schemas, etc.)
DocumentType.ReadYou can read an already available Document Type.
DocumentType.UpdateYou can update a document type that is already available. You can update anything inside a particular document type (for example, add or remove documents, add or remove annotations, add or remove fields, and others).
Extractor.CreateYou can create a new extractor.
Extractor.DeleteYou can delete an already available extractor.
Extractor.ReadYou can read the extractor.
Extractor.UpdateYou can update an extractor that is already available.
MonitorProcessedDocuments.ReadYou can read the processed documents from the Monitor section.
MonitorProcessedDocumentsDetail.ReadYou can read the processed documents detail from the Monitor section.
MonitorProjectPerformance.ReadYou can read the Projects Performance dashboard from the Monitor section.
Project.ReadYou can read the project.
Project.UpdateYou can update an already available project.
ProjectVersion.CreateYou can create new project versions.
ProjectVersion.ReadYou can read a project version.
ProjectVersion.UpdateYou can update an already available project version.
ProjectVersionLabel.ReadYou can read a project version label.

Document Understanding Model Trainer permissions

Permission

Description

Classifier.ReadYou can read the classifier.
Documents.DeleteYou can delete documents.
DocumentType.ReadYou can read an already available Document Type.
DocumentType.UpdateYou can update a document type that is already available. You can update anything inside a particular document type (for example, add or remove documents, add or remove annotations, add or remove fields, and others).
Extractor.ReadYou can read the extractor.
MonitorProcessedDocuments.ReadYou can read the processed documents from the Monitor section.
MonitorProcessedDocumentsDetail.ReadYou can read the processed documents detail from the Monitor section.
MonitorProjectPerformance.ReadYou can read the Projects Performance dashboard from the Monitor section.
Project.ReadYou can read the project.
ProjectVersion.CreateYou can create new project versions.
ProjectVersion.ReadYou can read a project version.
ProjectVersion.UpdateYou can update an already available project version.
ProjectVersionLabel.ReadYou can read a project version label.

Document Understanding Viewer permissions

Permission

Description

Classifier.ReadYou can read the classifier.
DocumentType.ReadYou can read an already available Document Type.
Extractor.ReadYou can read the extractor.
MonitorProcessedDocuments.ReadYou can read the processed documents from the Monitor section.
MonitorProjectPerformance.ReadYou can read the Projects Performance dashboard from the Monitor section.
Project.ReadYou can read the project.
ProjectVersion.ReadYou can read a project version.
ProjectVersionLabel.ReadYou can read a project version label.

Project Administrator permissions

Note: This role is only available at project level.

Permission

Description

Classifier.CreateYou can create a new classifier.
Classifier.DeleteYou can delete an already available classifier.
Classifier.ReadYou can read the classifier.
Classifier.UpdateYou can update a classifier that is already available.
DataSetExport.CreateYou can export a dataset from a project version and manage the visibility of the Download document(s) button.
DataSetExport.DeleteYou can delete a dataset export.
DataSetExport.ReadYou can read an available dataset export.
Documents.DeleteYou can delete documents.
DocumentType.CreateYou can create new document types.
DocumentType.DeleteYou can delete entire document types (including documents, annotations, schemas, etc.)
DocumentType.ReadYou can read an already available Document Type.
DocumentType.UpdateYou can update a document type that is already available. You can update anything inside a particular document type (for example, add or remove documents, add or remove annotations, add or remove fields, and others).
Extractor.CreateYou can create a new extractor.
Extractor.DeleteYou can delete an already available extractor.
Extractor.ReadYou can read the extractor.
Extractor.UpdateYou can update an extractor that is already available.
MonitorProcessedDocuments.ReadYou can read the processed documents from the Monitor section.
MonitorProcessedDocumentsDetail.ReadYou can read the processed documents detail from the Monitor section.
MonitorProjectPerformance.ReadYou can read the Projects Performance dashboard from the Monitor section.
Project.ReadYou can read the project.
Project.UpdateYou can update an already available project.
ProjectVersion.CreateYou can create new project versions.
ProjectVersion.DeleteYou can delete an already available project version.
ProjectVersion.ReadYou can read a project version.
ProjectVersion.UpdateYou can update an already available project version.
ProjectVersionLabel.CreateYou can create new project version labels.
ProjectVersionLabel.DeleteYou can delete an already available project version label.
ProjectVersionLabel.ReadYou can read a project version label.
ProjectVersionLabel.UpdateYou can update an already available project version label.

Creating a custom role

Apart from the default Document Understanding roles, you can also create and manage custom roles. Adapting custom roles to specific needs and permissions helps align them with organizational requirements.

Custom roles are available at both the tenant level, and the project level.

Tenant-level roles

The tenant-level roles can grant the following permissions:

Table 2. Standard permissions
Permission TypePermissionDescription
Authorization / ActionReadRead allows the users to read the actions or permissions when creating a custom role or when viewing a role.
Authorization / RoleReadView all roles.
Authorization / RoleUpdateUpdate custom roles.
Authorization / RoleCreateCreate custom roles.
Authorization / RoleDeleteDelete custom roles.
Authorization / Role AssignmentReadView all existing role assignments.
Authorization / Role AssignmentUpdateUpdate existing role assignments.
Authorization / Role AssignmentCreateCreate new role assignments.
Authorization / Role AssignmentDeleteDelete existing role assignments.
Document Understanding - Tenant SettingsReadRead Document Understanding tenant-level settings.
Document Understanding - Tenant SettingsUpdateUpdate Document Understanding tenant-level settings.
Document Understanding - Tenant SettingsCreateCreate Document Understanding tenant-level settings.
Table 3. Additional permissions
Permission TypePermissionDescription
Authorization / Role AssignmentExport role assignment dataExport role assignment data from the user interface.

Project-level roles

The project-level roles can grant the following permissions:

Table 4. Custom role project-level permissions
Permission TypePermissionDescription
Authorization / ActionReadRead allows the users to read the actions or permissions when creating a custom role or when viewing a role.
Authorization / RoleReadView all roles.
Authorization / RoleUpdateUpdate custom roles.
Authorization / RoleCreateCreate custom roles.
Authorization / RoleDeleteDelete custom roles.
Authorization / Role AssignmentReadView all existing role assignments.
Authorization / Role AssignmentUpdateUpdate existing role assignments.
Authorization / Role AssignmentCreateCreate new role assignments.
Authorization / Role AssignmentDeleteDelete existing role assignments.
Document Understanding - ClassifierReadView all classifiers.
Document Understanding - ClassifierUpdateUpdate classifiers.
Document Understanding - ClassifierCreateCreate classifiers.
Document Understanding - ClassifierDeleteDelete classifiers.
Document Understanding - Data Set ExportReadRead data set exports from a project version.
Document Understanding - Data Set ExportCreateExport data sets from a project version and manage the visibility of the download document(s) button.
Document Understanding - Data Set ExportDeleteDelete data set exports from a project version.
Document Understanding - Document TypeReadRead document types.
Document Understanding - Document TypeUpdateUpdate document types.
Document Understanding - Document TypeCreateCreate document types.
Document Understanding - Document TypeDeleteDelete document types.
Document Understanding - DocumentsDeleteDelete documents from a project.
Document Understanding - ExtractorReadView extractors.
Document Understanding - ExtractorUpdateUpdate extractors.
Document Understanding - ExtractorCreateCreate extractors.
Document Understanding - ExtractorDeleteDelete extractors.
Document Understanding - Monitor Processed DocumentsReadView processed documents.
Document Understanding - Monitor Processed Documents Detail ReadView details for processed documents
Document Understanding - Monitor Project PerformanceReadView the project performance.
Document Understanding - ProjectReadView projects.
Document Understanding - ProjectUpdateUpdate projects.
Document Understanding - ProjectCreateCreate projects.
Document Understanding - ProjectDeleteDelete projects.
Document Understanding - Project VersionReadView project versions.
Document Understanding - Project VersionUpdateUpdate project versions.
Document Understanding - Project VersionCreateCreate project versions.
Document Understanding - Project VersionDeleteDelete project versions.
Document Understanding - Project Version LabelReadView project version labels.
Document Understanding - Project Version LabelUpdateUpdate project version labels.
Document Understanding - Project Version LabelCreateCreate project version labels.
Document Understanding - Project Version LabelDeleteDelete project version labels.
Table 5. Additional permissions
Permission TypePermissionDescription
Authorization / Role AssignmentExport role assignment dataExport role assignment data from the user interface.
Document UnderstandingUse extractors and classifiers from projects.Use the same extractors and classifiers used inside projects.

Creating a custom role

To create a custom role:
  1. Navigate to your respective Automation CloudTM URL and log in with your UiPath® account.
  2. From the left-side navigation pane, select Document Understanding.
  3. Select the Manage access button.

    docs image
  4. Go to the Roles tab, select Create role, and fill in the following fields:
    • Role name - Give your role a descriptive name.
    • Description - Optionally, provide a description.
    • Category - Choose between:
      • Tenant - You can assign this role at tenant-level. It consists of tenant-level permissions.
      • Project - You can assign this role to existing or new projects. It consists of project-level permissions.
  5. Select Next to proceed to the permissions page.
  6. In the Standard permissions and Additional permissions tabs, select the permissions to assign to the custom role.
  7. Select Create.

Viewing a custom role

To view a custom role:
  1. Navigate to your respective Automation CloudTM URL and log in with your UiPath® account.
  2. From the left-side navigation pane, select Document Understanding.
  3. Select the Manage access button.
  4. Go to the Roles tab and select the ellipsis for the custom role you want to view.
  5. Select View.

Editing a custom role

To edit a custom role:
  1. Navigate to your respective Automation CloudTM URL and log in with your UiPath® account.
  2. From the left-side navigation pane, select Document Understanding.
  3. Select the Manage access button.
  4. Go to the Roles tab and select the ellipsis for the custom role you want to view.
  5. Select Edit to modify the description and permissions of the custom role.
  6. After making the changes, select Update.

Duplicating a custom role

To duplicate a custom role:
  1. Navigate to your respective Automation CloudTM URL and log in with your UiPath® account.
  2. From the left-side navigation pane, select Document Understanding.
  3. Select the Manage access button.
  4. Go to the Roles tab and select the ellipsis for the custom role you want to view.
  5. Select Duplicate & customize, to create a copy of the role and modify its description and permissions.
  6. After making the changes, select Create.

Removing a custom role

To remove a custom role:
  1. Navigate to your respective Automation CloudTM URL and log in with your UiPath® account.
  2. From the left-side navigation pane, select Document Understanding.
  3. Select the Manage access button.
  4. Go to the Roles tab and select the ellipsis for the custom role you want to view.
  5. Select Delete.
    Note: Deleting a custom role also removes all associated role assignments.

Was this page helpful?

Get The Help You Need
Learning RPA - Automation Courses
UiPath Community Forum
Uipath Logo
Trust and Security
© 2005-2025 UiPath. All rights reserved.