Why Can't I See Agents, Workflows, or Other Sections in Dave by voolama?

Every sidebar section in Dave by voolama (hellodave.ai) requires a specific permission. The permission strings below are the actual identifiers enforced at the API layer, drawn verbatim from the getting-started help documentation, DEV v0.11.0, confirmed against content_orchestrator main at commit ddb945f, 2026-08-30. Any Admin can verify them: navigate to Admin, then Settings, then Users and Roles, inspect the role badge labels, or check the 403 response body in browser developer tools, which names the missing permission string directly.

This permission model implements NIST SP 800-53 Rev 5 AC-6 (Least Privilege, section 6a): "Employ the principle of least privilege, allowing only authorized accesses for users which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions." A Use-role user who completes review tasks has no access to Agents or Workflows because those sections are not necessary for their assigned tasks. The platform enforces this at both the UI layer (sidebar filtering) and the API layer (403 on direct URL access, server-side, not bypassable by URL manipulation).

Dave by voolama has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. A user can hold multiple roles simultaneously.

Two non-obvious cases:

• Create role cannot see Workflows. A user with only the Create role can build and version agents but cannot open the Workflows section. Workflow design requires the Curate role.
• Reports requires both a role and a feature flag. The Reporting role grants reports:read, but the Reports sidebar link only appears if the reporting feature flag is also enabled. If a Reporting-role user still cannot see Reports after role assignment, ask an Admin to check the feature flag at Admin, then Settings, then Feature Flags.

When a user reports a missing sidebar section in Dave by voolama (hellodave.ai), an Admin follows this sequence. All steps require the Admin role. Sourced from the getting-started help documentation, DEV v0.11.0, confirmed 2026-08-30.

1. Identify the missing section and required role. Ask the user which sidebar section they cannot see. Use the permission table above to find the required permission and the role that grants it. Concrete example: user cannot see Workflows. Required permission: workflows:read. Roles that grant it: Admin or Curate. User's current role: Use. Fix: add Curate.

2. Navigate to User Management. Go to Admin, then Settings, then Users and Roles. Find the user's row by email address or username.

3. Check the user's current roles. The role badges on the user's row show their current assignments. Confirm that none of the badges match the role required for the missing section.

4. Add the required role. Click Edit on the user's row. Toggle the required role badge to the active (coloured) state. Click Save.

5. Tell the user to log out and back in. Role changes take effect on the user's next login. The user must log out and log back in before the new sidebar section appears. A browser refresh alone is not sufficient: the session token must be renewed to carry the updated role assignment.

6. Confirm the section is now visible. Ask the user to confirm the sidebar section now appears. If it still does not appear, return to the user's row in Users and Roles and confirm the badge is saved in the active state.

Multiple roles in a single edit: if the user needs access to more than one section requiring different roles, assign all required roles in a single Edit session. Toggle all required badges to active and click Save once. The getting-started help documentation states: "A user can hold multiple roles simultaneously."

For the full user management path including reactivation, see How Do I Remove a Team Member's Access in Dave by voolama? and Checklist for Onboarding a Team onto AI Workflow Automation.

Two related troubleshooting scenarios from the getting-started help documentation, DEV v0.11.0, confirmed 2026-08-30.

Scenario 1: 403 Forbidden when navigating directly to a URL

The getting-started help documentation states: "Even if you type a URL directly into the browser address bar, the platform enforces role-based access and blocks unauthorized requests. This is expected behavior -- you can only access pages that match your assigned role(s). Do not attempt to bypass access controls."

NIST SP 800-53 Rev 5 AC-3 (Access Enforcement, section 3a) requires: "Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies." The 403 response is server-side enforcement of that control. It cannot be bypassed by URL manipulation.

Fix: identify the page from the URL path. A URL containing /workflows requires workflows:read, granted by Admin or Curate. A URL containing /agents requires agents:read, granted by Admin, Create, or Curate. Find the required role from the permission table above. Ask your Admin to assign that role at Admin, then Settings, then Users and Roles. Log out and back in.

Scenario 2: Login failed error

The getting-started help documentation documents three causes:

• Wrong tenant URL or subdomain: the login page detects your tenant automatically from the subdomain. Confirm your tenant subdomain URL with your Admin.
• Wrong tenant ID (manual entry): if the login page shows a Tenant ID field, enter the full UUID provided by your Admin (for example, 00000000-0000-4000-a000-000000000001).
• Account status is inactive: the getting-started help documentation states: "If your account status is set to 'inactive', ask your administrator to reactivate it." See How Do I Remove a Team Member's Access in Dave by voolama? for the reactivation path.