Summary

By default, SAS Viya Copilot is available to every authenticated user in the environment. As a SAS Administrator, you can limit that availability so that only an approved set of users can see and use the Copilot.

This is achieved by creating a custom group for the approved users, disabling the default authorization rule that grants access to AuthenticatedUsers, and replacing it with an equivalent rule scoped to the new group. Users who are not members of the group can no longer see the Copilot icon in the user interface and cannot invoke it.

1. Prerequisites

Before you begin, confirm the following:

• You are a member of the SAS Administrators group, or you otherwise have permission to manage users and authorization rules.
• SAS Viya Copilot is deployed and enabled in the environment.
• You have access to SAS^® Environment Manager.
• You have the list of users who should retain access to the Copilot.

Recommendation:    Apply and test this procedure in a non-production environment first.    Authorization rule changes take effect immediately for all users.

 

2. Create a custom group for Copilot users

1. Sign in to SAS Environment Manager as an administrator.
2. In the left navigation pane, select Users and Groups.
3. Change the view selector to Custom Groups.
4. Click New Custom Group (the + icon).
5. Provide a name and an ID for the group, for example:
   1. Name: Viya Copilot Users
   2. ID: ViyaCopilotUsers
6. Optionally add a description and then click Save.

Use an ID that is easy to identify later, because you will reference this group when you create the authorization rule.

 

3. Add the approved users to the group

1. On the Custom Groups view, select the group that you created in the previous step.
2. Click Edit in the Members section.
3. Search for each approved user or group and add it to the members list.
4. Click OK to save your changes.

You can add individual users, other custom groups, or LDAP groups, depending on how identities are managed in your environment.

 

4. Disable the default rule for AuthenticatedUsers

This step removes the broad, environment-wide grant that makes the Copilot available to everyone.

1. In SAS Environment Manager, select Rules in the left navigation pane.
2. In the search field, enter the following Object URI pattern:

/genAiGateway/*/status

3. In the results, locate the rule where the Principal is AuthenticatedUsers.
4. Select the rule and click Edit, as shown below.
5. Set the rule to disabled and click Save.

Result: The Copilot icon is no longer displayed for authenticated users. At this point, no one has   access through this rule, including the members of your new custom group. Access is restored for   that group in the next step.

 

 

5. Create a copy of the rule scoped to the custom group

Rather than editing the original rule, create a copy of it. This preserves the default rule so that you can re-enable it later if you need to revert the change.

1. On the Rules page, select the rule that you disabled in the previous step.
2. Click Copy to create a new rule based on it.
3. In the new rule, change the following fields, as shown below:
   1. Principal Type: Group
   2. Principal: the custom group that you created (for example, Viya Copilot Users)
4. Leave the object URI, permissions, and access type unchanged, so that the copy matches the original rule in every other respect.
5. Confirm that the new rule is enabled.
6. Click Save.

 

6. Validate the configuration

Test the outcome with two different accounts:

Test Account	Expected Result
A user who is a member of the custom group	The Copilot icon is visible, and the Copilot can be used normally.
A user who is not a member of the custom group	The Copilot icon is not displayed, and the Copilot cannot be invoked.

 

If a user does not see the expected behavior, ask them to sign out and sign back in so that their group memberships and permissions are refreshed, as shown below:

 

7. Notes and considerations

• Reverting the change: To restore the default behavior, re-enable the original AuthenticatedUsers rule. You can leave the group-scoped rule in place or delete it.
• Managing access over time: After the rules are configured, you only need to add users to or remove them from the custom group. No further rule changes are required.
• Caching: Changes to authorization rules and group memberships might take a short time to be reflected in an active session. Signing out and back in is the quickest way to confirm the result.
• Upgrades: Deployment updates can reintroduce or reset default authorization rules. Re-validate this configuration after an upgrade.