> ## Documentation Index
> Fetch the complete documentation index at: https://helloluciallc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Eval Labs Roles and Access Matrix

> Who can do what across Eval Labs' testing, verification, and analysis surfaces.

<Note>
  Eval Labs is a role-based human evaluation platform for Lucia. Clerk role metadata drives product behavior, and persisted evidence must remain protected by Supabase RLS.
</Note>

## Role metadata

Eval Labs reads the current role from Clerk public metadata:

```json theme={"dark"}
{ "eval_labs_role": "owner | admin | evaluator | tester" }
```

Supported values are `owner`, `admin`, `evaluator`, `tester`, or missing/unassigned. **Missing, unassigned, or unknown role metadata must fail closed.**

## Access matrix

Access widens by role — from a single prompt test up to the full owner/admin workspace.

<table className="hl-matrix">
  <thead>
    <tr>
      <th>Role</th>
      <th>Custom Prompt</th>
      <th>Auto-generated</th>
      <th>Verification Check</th>
      <th>Verification Results</th>
      <th>Controlled Batch</th>
      <th>Team Review</th>
      <th>Global Analysis</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <th><span className="hl-role"><span className="hl-tag">owner</span></span><div className="hl-meter"><span style={{ width: '100%' }} /></div> 7 / 7</th>
      <td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td>
    </tr>

    <tr>
      <th><span className="hl-role"><span className="hl-tag">admin</span></span><div className="hl-meter"><span style={{ width: '100%' }} /></div> 7 / 7</th>
      <td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td>
    </tr>

    <tr>
      <th><span className="hl-role"><span className="hl-tag">evaluator</span></span><div className="hl-meter"><span style={{ width: '71%' }} /></div> 5 / 7</th>
      <td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-deny">–</td><td className="hl-deny">–</td>
    </tr>

    <tr>
      <th><span className="hl-role"><span className="hl-tag">tester</span></span><div className="hl-meter"><span style={{ width: '29%' }} /></div> 2 / 7</th>
      <td className="hl-grant">✓</td><td className="hl-grant">✓</td><td className="hl-deny">–</td><td className="hl-deny">–</td><td className="hl-deny">–</td><td className="hl-deny">–</td><td className="hl-deny">–</td>
    </tr>

    <tr>
      <th><span className="hl-role"><span className="hl-tag">unassigned</span></span><div className="hl-meter"><span style={{ width: '0%' }} /></div> 0 / 7</th>
      <td className="hl-deny">–</td><td className="hl-deny">–</td><td className="hl-deny">–</td><td className="hl-deny">–</td><td className="hl-deny">–</td><td className="hl-deny">–</td><td className="hl-deny">–</td>
    </tr>
  </tbody>
</table>

## Role definitions

| Role           | Access | Scope                                                           |
| -------------- | ------ | --------------------------------------------------------------- |
| **owner**      | 7 / 7  | Full platform access, oversight, and final product judgment.    |
| **admin**      | 7 / 7  | Full surface access; trusted operational oversight.             |
| **evaluator**  | 5 / 7  | Full evaluator workbench. No Team Review or Global Analysis.    |
| **tester**     | 2 / 7  | Entry-level prompt-testing lane only (Custom + Auto-generated). |
| **unassigned** | 0 / 7  | No recognized role. Fails closed — no protected access.         |

<Info>
  Supabase RLS protects persisted evidence. The Clerk session token includes `eval_labs_role` so RLS can recognize privileged owner/admin access. Real runs must persist to Supabase before they count as durable evidence.
</Info>