To set up group-based access control where users from your MS Entra/Auth0 "IMAGO" group can access specific AI agents, you'll want to sync users with their group membership and then check permissions in your frontend. ​*Backend Setup:*​ When syncing users from Auth0, include group membership as user attributes (1) :

{  
  key: "user_id",  
  email: "<mailto:email@example.com|email@example.com>",  
  first_name: "John",  
  last_name: "Smith",  
  attributes: {
    auth0_group: "IMAGO"
  }  
}

​*Frontend Filtering:*​ For filtering your 50 agents in the client based on group assignment, you can use Permit's frontend SDK to check permissions before displaying resources (2) . The SDK allows you to load user permissions and perform client-side checks . Initialize the Permit frontend SDK with your logged-in user :

const permit = Permit({
  loggedInUser: loggedInUser,
  backendUrl: "<http://localhost:4000/>",
}) ;

Then check permissions for each agent resource :

await permit.loadLocalStateBulk([
  { action: "access", resource: "AI_Agent" }
]) ;

​*Policy Configuration:*​ In Permit's Policy Editor, create a policy that grants the "access" action on "AI_Agent" resources to users with the

auth0_group

attribute set to "IMAGO" (3) . This uses Attribute-Based Access Control (ABAC) to evaluate user attributes dynamically

To learn more, see the sources I considered: [[1] Sync Users](https://docs.permit.io/how-to/sync-users) [[2] How to Implement Role-Based Access Control (RBAC) in Angular](https://www.permit.io/blog/how-to-implement-role-based-access-control-rbac-in-angular) [[3] How to Implement Attribute-Based Access Control (ABAC) Authorization?](https://www.permit.io/blog/how-to-implement-abac)

ABAC it is, great