feat: restrict Editor role to Document Ingestion tab only in Gradio UI

app.py

@@ -15,8 +15,28 @@ except ImportError:
 
 BACKEND_BASE_URL = os.getenv("BACKEND_BASE_URL", "http://localhost:8000")
 
+# Role-based access control permissions
+VALID_ROLES = ["viewer", "editor", "admin", "owner"]
+DEFAULT_ROLE = "viewer"
 
-def chat_with_agent(message, tenant_id, history):
+def can_manage_rules(role: str) -> bool:
+    """Check if role can manage rules (admin/owner only)."""
+    return role in ["admin", "owner"]
+
+def can_ingest_documents(role: str) -> bool:
+    """Check if role can ingest documents (editor/admin/owner)."""
+    return role in ["editor", "admin", "owner"]
+
+def can_delete_documents(role: str) -> bool:
+    """Check if role can delete documents (admin/owner only)."""
+    return role in ["admin", "owner"]
+
+def can_view_analytics(role: str) -> bool:
+    """Check if role can view analytics (admin/owner only)."""
+    return role in ["admin", "owner"]
+
+
+def chat_with_agent(message, tenant_id, role, history):
     """
     Send a message to the backend MCP agent and return the response.
     Uses streaming for real-time word-by-word updates.
@@ -55,12 +75,19 @@ def chat_with_agent(message, tenant_id, history):
         "temperature": 0.0
     }
     
+    # Prepare headers with role
+    headers = {
+        "Content-Type": "application/json",
+        "x-tenant-id": tenant_id.strip(),
+        "x-user-role": role if role else DEFAULT_ROLE
+    }
+    
     try:
         # Make streaming request
         response = requests.post(
             backend_url,
             json=payload,
-            headers={"Content-Type": "application/json"},
+            headers=headers,
             stream=True,
             timeout=120
         )
@@ -144,6 +171,7 @@ def chat_with_agent(message, tenant_id, history):
 
 def ingest_document(
     tenant_id: str,
+    role: str,
     source_type: str,
     content: str,
     document_url: str,
@@ -153,6 +181,9 @@ def ingest_document(
 ):
     if not tenant_id or not tenant_id.strip():
         return "❗ Tenant ID is required to ingest documents."
+    
+    if not can_ingest_documents(role):
+        return "❌ Access Denied: You need Editor, Admin, or Owner role to ingest documents."
 
     tenant_id = tenant_id.strip()
 
@@ -187,10 +218,15 @@ def ingest_document(
     }
 
     try:
+        headers = {
+            "Content-Type": "application/json",
+            "x-tenant-id": tenant_id,
+            "x-user-role": role if role else DEFAULT_ROLE
+        }
         response = requests.post(
             f"{BACKEND_BASE_URL}/rag/ingest-document",
             json=payload,
-            headers={"Content-Type": "application/json"},
+            headers=headers,
             timeout=60
         )
         if response.status_code == 200:
@@ -205,11 +241,14 @@ def ingest_document(
         return f"❌ Unexpected error during ingestion: {exc}"
 
 
-def ingest_file(tenant_id: str, file_obj):
+def ingest_file(tenant_id: str, role: str, file_obj):
     if not tenant_id or not tenant_id.strip():
         return "❗ Tenant ID is required to ingest files."
     if file_obj is None:
         return "❗ Please select a file to upload."
+    
+    if not can_ingest_documents(role):
+        return "❌ Access Denied: You need Editor, Admin, or Owner role to ingest files."
 
     tenant_id = tenant_id.strip()
 
@@ -221,10 +260,14 @@ def ingest_file(tenant_id: str, file_obj):
         files = {
             "file": (file_path.name, file_bytes, "application/octet-stream")
         }
+        headers = {
+            "x-tenant-id": tenant_id,
+            "x-user-role": role if role else DEFAULT_ROLE
+        }
         response = requests.post(
             f"{BACKEND_BASE_URL}/rag/ingest-file",
             files=files,
-            headers={"x-tenant-id": tenant_id},
+            headers=headers,
             timeout=120
         )
         if response.status_code == 200:
@@ -245,15 +288,19 @@ def _format_rules_table(rules: list[str]) -> list[list]:
     return [[idx + 1, rule] for idx, rule in enumerate(rules)]
 
 
-def fetch_admin_rules(tenant_id: str) -> tuple[str, list[list]]:
+def fetch_admin_rules(tenant_id: str, role: str) -> tuple[str, list[list]]:
     if not tenant_id or not tenant_id.strip():
         return "❗ Tenant ID is required.", []
 
     tenant_id = tenant_id.strip()
     try:
+        headers = {
+            "x-tenant-id": tenant_id,
+            "x-user-role": role if role else DEFAULT_ROLE
+        }
         response = requests.get(
             f"{BACKEND_BASE_URL}/admin/rules",
-            headers={"x-tenant-id": tenant_id},
+            headers=headers,
             timeout=30
         )
         if response.status_code == 200:
@@ -335,11 +382,14 @@ def extract_rules_from_file(file_path) -> str:
         return f"❌ Error reading file: {str(e)}"
 
 
-def add_admin_rules(tenant_id: str, rules_text: str) -> str:
+def add_admin_rules(tenant_id: str, role: str, rules_text: str) -> str:
     if not tenant_id or not tenant_id.strip():
         return "❗ Tenant ID is required."
     if not rules_text or not rules_text.strip():
         return "❗ Provide at least one rule to upload."
+    
+    if not can_manage_rules(role):
+        return "❌ Access Denied: You need Admin or Owner role to manage rules."
 
     tenant_id = tenant_id.strip()
     # Filter out comment lines (starting with #) and empty lines
@@ -362,10 +412,14 @@ def add_admin_rules(tenant_id: str, rules_text: str) -> str:
     if total_rules == 1:
         # Single rule - use regular endpoint
         try:
+            headers = {
+                "x-tenant-id": tenant_id,
+                "x-user-role": role if role else DEFAULT_ROLE
+            }
             resp = requests.post(
                 f"{BACKEND_BASE_URL}/admin/rules",
                 params={"rule": rules[0], "enhance": "true"},
-                headers={"x-tenant-id": tenant_id},
+                headers=headers,
                 timeout=30
             )
             if resp.status_code == 200:
@@ -392,10 +446,14 @@ def add_admin_rules(tenant_id: str, rules_text: str) -> str:
             total_chunks = (total_rules + CHUNK_SIZE - 1) // CHUNK_SIZE
             
             try:
+                headers = {
+                    "x-tenant-id": tenant_id,
+                    "x-user-role": role if role else DEFAULT_ROLE
+                }
                 resp = requests.post(
                     f"{BACKEND_BASE_URL}/admin/rules/bulk",
                     json={"rules": chunk},
-                    headers={"x-tenant-id": tenant_id},
+                    headers=headers,
                     params={"enhance": "true"},
                     timeout=45  # Timeout per chunk (5 rules)
                 )
@@ -428,19 +486,26 @@ def add_admin_rules(tenant_id: str, rules_text: str) -> str:
     return "\n\n".join(summary) if summary else "No rules were added."
 
 
-def delete_admin_rule(tenant_id: str, rule: str) -> str:
+def delete_admin_rule(tenant_id: str, role: str, rule: str) -> str:
     if not tenant_id or not tenant_id.strip():
         return "❗ Tenant ID is required."
     if not rule or not rule.strip():
         return "❗ Provide the exact rule text to delete."
+    
+    if not can_manage_rules(role):
+        return "❌ Access Denied: You need Admin or Owner role to delete rules."
 
     tenant_id = tenant_id.strip()
     rule = rule.strip()
 
     try:
+        headers = {
+            "x-tenant-id": tenant_id,
+            "x-user-role": role if role else DEFAULT_ROLE
+        }
         resp = requests.delete(
             f"{BACKEND_BASE_URL}/admin/rules/{rule}",
-            headers={"x-tenant-id": tenant_id},
+            headers=headers,
             timeout=15
         )
         if resp.status_code == 200:
@@ -454,7 +519,7 @@ def delete_admin_rule(tenant_id: str, rule: str) -> str:
         return f"❌ Unexpected error: {exc}"
 
 
-def add_rules_from_file(tenant_id: str, file_path):
+def add_rules_from_file(tenant_id: str, role: str, file_path):
     """
     Extract rules from uploaded file and add them.
     """
@@ -477,31 +542,38 @@ def add_rules_from_file(tenant_id: str, file_path):
         return "❗ No text could be extracted from the file.", summary, rows
     
     # Add rules from extracted text
-    status = add_admin_rules(tenant_id, extracted_text)
-    summary, rows = fetch_admin_rules(tenant_id)
+    status = add_admin_rules(tenant_id, role, extracted_text)
+    summary, rows = fetch_admin_rules(tenant_id, role)
     return status, summary, rows
 
 
-def add_rules_and_refresh(tenant_id: str, rules_text: str):
-    status = add_admin_rules(tenant_id, rules_text)
-    summary, rows = fetch_admin_rules(tenant_id)
+def add_rules_and_refresh(tenant_id: str, role: str, rules_text: str):
+    status = add_admin_rules(tenant_id, role, rules_text)
+    summary, rows = fetch_admin_rules(tenant_id, role)
     return status, summary, rows
 
 
-def delete_rule_and_refresh(tenant_id: str, rule: str):
-    status = delete_admin_rule(tenant_id, rule)
-    summary, rows = fetch_admin_rules(tenant_id)
+def delete_rule_and_refresh(tenant_id: str, role: str, rule: str):
+    status = delete_admin_rule(tenant_id, role, rule)
+    summary, rows = fetch_admin_rules(tenant_id, role)
     return status, summary, rows
 
 
-def fetch_admin_analytics(tenant_id: str):
+def fetch_admin_analytics(tenant_id: str, role: str):
     """Fetch analytics data and return formatted results with visualizations."""
     if not tenant_id or not tenant_id.strip():
         error_msg = "❗ Tenant ID is required to view analytics."
         return error_msg, {}, None, None, None, None
+    
+    if not can_view_analytics(role):
+        error_msg = "❌ Access Denied: You need Admin or Owner role to view analytics."
+        return error_msg, {}, None, None, None, None
 
     tenant_id = tenant_id.strip()
-    headers = {"x-tenant-id": tenant_id}
+    headers = {
+        "x-tenant-id": tenant_id,
+        "x-user-role": role if role else DEFAULT_ROLE
+    }
     
     overview_data = {}
     tool_usage_data = {}
@@ -776,7 +848,7 @@ def fetch_admin_analytics(tenant_id: str):
     return summary_text, tool_usage, tool_chart, latency_chart, rag_chart, error_msg
 
 
-def list_documents(tenant_id: str, limit: int = 1000, offset: int = 0):
+def list_documents(tenant_id: str, role: str, limit: int = 1000, offset: int = 0):
     """
     List all documents for a tenant.
     Returns a tuple of (status_message, documents_list, total_count, stats_dict, chart_fig).
@@ -786,10 +858,14 @@ def list_documents(tenant_id: str, limit: int = 1000, offset: int = 0):
     
     tenant_id = tenant_id.strip()
     try:
+        headers = {
+            "x-tenant-id": tenant_id,
+            "x-user-role": role if role else DEFAULT_ROLE
+        }
         response = requests.get(
             f"{BACKEND_BASE_URL}/rag/list",
             params={"tenant_id": tenant_id, "limit": limit, "offset": offset},
-            headers={"x-tenant-id": tenant_id},
+            headers=headers,
             timeout=30
         )
         
@@ -890,7 +966,7 @@ def list_documents(tenant_id: str, limit: int = 1000, offset: int = 0):
         return f"❌ Unexpected error: {exc}", [], 0, {}, None
 
 
-def delete_document(tenant_id: str, document_id: int):
+def delete_document(tenant_id: str, role: str, document_id: int):
     """Delete a specific document by ID."""
     if not tenant_id or not tenant_id.strip():
         return "❗ Tenant ID is required."
@@ -898,12 +974,19 @@ def delete_document(tenant_id: str, document_id: int):
     if not document_id or document_id <= 0:
         return "❗ Invalid document ID."
     
+    if not can_delete_documents(role):
+        return "❌ Access Denied: You need Admin or Owner role to delete documents."
+    
     tenant_id = tenant_id.strip()
     try:
+        headers = {
+            "x-tenant-id": tenant_id,
+            "x-user-role": role if role else DEFAULT_ROLE
+        }
         response = requests.delete(
             f"{BACKEND_BASE_URL}/rag/delete/{document_id}",
             params={"tenant_id": tenant_id},
-            headers={"x-tenant-id": tenant_id},
+            headers=headers,
             timeout=30
         )
         
@@ -923,17 +1006,25 @@ def delete_document(tenant_id: str, document_id: int):
         return f"❌ Unexpected error: {exc}"
 
 
-def delete_all_documents(tenant_id: str):
+def delete_all_documents(tenant_id: str, role: str):
     """Delete all documents for a tenant."""
     if not tenant_id or not tenant_id.strip():
         return "❗ Tenant ID is required."
     
     tenant_id = tenant_id.strip()
+    
+    if not can_delete_documents(role):
+        return "❌ Access Denied: You need Admin or Owner role to delete documents."
+    
     try:
+        headers = {
+            "x-tenant-id": tenant_id,
+            "x-user-role": role if role else DEFAULT_ROLE
+        }
         response = requests.delete(
             f"{BACKEND_BASE_URL}/rag/delete-all",
             params={"tenant_id": tenant_id},
-            headers={"x-tenant-id": tenant_id},
+            headers=headers,
             timeout=60
         )
         
@@ -953,7 +1044,7 @@ def delete_all_documents(tenant_id: str):
         return f"❌ Unexpected error: {exc}"
 
 
-def search_knowledge_base(tenant_id: str, query: str):
+def search_knowledge_base(tenant_id: str, role: str, query: str):
     """Search the knowledge base using RAG semantic search."""
     if not tenant_id or not tenant_id.strip():
         return "❗ Tenant ID is required.", []
@@ -965,10 +1056,15 @@ def search_knowledge_base(tenant_id: str, query: str):
     query = query.strip()
     
     try:
+        headers = {
+            "x-tenant-id": tenant_id,
+            "x-user-role": role if role else DEFAULT_ROLE,
+            "Content-Type": "application/json"
+        }
         response = requests.post(
             f"{BACKEND_BASE_URL}/rag/search",
             json={"tenant_id": tenant_id, "query": query, "threshold": 0.3},
-            headers={"x-tenant-id": tenant_id, "Content-Type": "application/json"},
+            headers=headers,
             timeout=30
         )
         
@@ -1002,115 +1098,294 @@ def search_knowledge_base(tenant_id: str, query: str):
 # Create Gradio interface
 with gr.Blocks(
     title="IntegraChat — MCP Autonomous Agent", 
-    theme=gr.themes.Soft(),
+    theme=gr.themes.Soft(
+        primary_hue="cyan",
+        secondary_hue="blue",
+        neutral_hue="slate",
+        font=("Inter", "system-ui", "sans-serif")
+    ),
     css="""
-    .stat-card {
-        background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+    /* Global improvements */
+    .gradio-container {
+        font-family: 'Inter', system-ui, -apple-system, sans-serif;
+    }
+    
+    /* Header styling */
+    .header-section {
+        background: linear-gradient(135deg, #0f172a 0%, #1e293b 50%, #334155 100%);
+        padding: 32px 24px;
+        border-radius: 16px;
+        margin-bottom: 24px;
+        box-shadow: 0 8px 32px rgba(0, 0, 0, 0.2);
+        border: 1px solid rgba(148, 163, 184, 0.1);
+    }
+    
+    .header-section h1 {
+        background: linear-gradient(135deg, #06b6d4 0%, #3b82f6 100%);
+        -webkit-background-clip: text;
+        -webkit-text-fill-color: transparent;
+        background-clip: text;
+        font-size: 2.5rem;
+        font-weight: 700;
+        margin-bottom: 12px;
+    }
+    
+    /* Input fields styling */
+    .input-container {
+        background: rgba(255, 255, 255, 0.05);
         padding: 20px;
         border-radius: 12px;
+        border: 1px solid rgba(148, 163, 184, 0.2);
+        backdrop-filter: blur(10px);
+    }
+    
+    /* Stat cards with better gradients */
+    .stat-card {
+        background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+        padding: 24px;
+        border-radius: 16px;
         color: white;
         text-align: center;
-        box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
-        transition: transform 0.2s;
+        box-shadow: 0 8px 24px rgba(102, 126, 234, 0.3);
+        transition: all 0.3s cubic-bezier(0.4, 0, 0.2, 1);
+        border: 1px solid rgba(255, 255, 255, 0.1);
     }
     .stat-card:hover {
-        transform: translateY(-2px);
-        box-shadow: 0 6px 12px rgba(0, 0, 0, 0.15);
+        transform: translateY(-4px) scale(1.02);
+        box-shadow: 0 12px 32px rgba(102, 126, 234, 0.4);
     }
     .stat-card h3 {
-        margin: 0 0 10px 0;
+        margin: 0 0 12px 0;
         font-size: 14px;
-        opacity: 0.9;
+        opacity: 0.95;
+        font-weight: 500;
+        letter-spacing: 0.5px;
+        text-transform: uppercase;
     }
     .stat-card strong {
-        font-size: 24px;
-        font-weight: bold;
+        font-size: 32px;
+        font-weight: 700;
+        display: block;
+        margin-top: 8px;
     }
+    
+    /* Enhanced summary box */
     .summary-box {
-        background: linear-gradient(135deg, #1f2937 0%, #111827 100%);
-        padding: 24px;
-        border-radius: 12px;
-        border: 2px solid #374151;
+        background: linear-gradient(135deg, #0f172a 0%, #1e293b 50%, #334155 100%);
+        padding: 28px;
+        border-radius: 16px;
+        border: 1px solid rgba(148, 163, 184, 0.2);
         max-height: 500px;
         overflow-y: auto;
-        box-shadow: 0 4px 6px rgba(0, 0, 0, 0.3);
-        color: #f9fafb;
+        box-shadow: 0 8px 32px rgba(0, 0, 0, 0.3);
+        color: #f1f5f9;
+        backdrop-filter: blur(10px);
+    }
+    .summary-box::-webkit-scrollbar {
+        width: 8px;
+    }
+    .summary-box::-webkit-scrollbar-track {
+        background: rgba(255, 255, 255, 0.05);
+        border-radius: 4px;
+    }
+    .summary-box::-webkit-scrollbar-thumb {
+        background: rgba(148, 163, 184, 0.3);
+        border-radius: 4px;
+    }
+    .summary-box::-webkit-scrollbar-thumb:hover {
+        background: rgba(148, 163, 184, 0.5);
     }
     .summary-box h3, .summary-box h4 {
         margin-top: 0;
-        margin-bottom: 12px;
+        margin-bottom: 16px;
         color: #ffffff;
         font-weight: 600;
     }
     .summary-box h4 {
-        color: #e5e7eb;
+        color: #e2e8f0;
         font-size: 16px;
-        margin-top: 20px;
-        margin-bottom: 10px;
+        margin-top: 24px;
+        margin-bottom: 12px;
     }
     .summary-box p {
-        color: #f3f4f6;
-        margin: 8px 0;
-        line-height: 1.6;
+        color: #f1f5f9;
+        margin: 10px 0;
+        line-height: 1.7;
     }
     .summary-box ul {
-        margin: 10px 0;
-        padding-left: 24px;
-        color: #f3f4f6;
+        margin: 12px 0;
+        padding-left: 28px;
+        color: #f1f5f9;
     }
     .summary-box li {
-        margin: 8px 0;
-        color: #f3f4f6;
-        line-height: 1.6;
+        margin: 10px 0;
+        color: #f1f5f9;
+        line-height: 1.7;
     }
     .summary-box code {
-        background-color: #000000;
-        color: #00ff00;
-        padding: 2px 6px;
-        border-radius: 4px;
-        font-family: 'Courier New', monospace;
+        background-color: rgba(0, 0, 0, 0.4);
+        color: #00ff88;
+        padding: 3px 8px;
+        border-radius: 6px;
+        font-family: 'Fira Code', 'Courier New', monospace;
         font-size: 13px;
-        border: 1px solid #374151;
+        border: 1px solid rgba(148, 163, 184, 0.2);
     }
     .summary-box hr {
         border: none;
-        border-top: 1px solid #4b5563;
-        margin: 16px 0;
+        border-top: 1px solid rgba(148, 163, 184, 0.2);
+        margin: 20px 0;
     }
     .summary-box strong {
         color: #ffffff;
+        font-weight: 600;
     }
+    
+    /* Chart titles */
     .chart-title {
-        margin-bottom: 8px;
+        margin-bottom: 12px;
         margin-top: 0;
         font-weight: 600;
-        color: #1f2937;
+        color: #1e293b;
         text-align: center;
+        font-size: 18px;
+    }
+    
+    /* Button enhancements */
+    button.primary {
+        background: linear-gradient(135deg, #06b6d4 0%, #3b82f6 100%);
+        border: none;
+        box-shadow: 0 4px 12px rgba(6, 182, 212, 0.3);
+        transition: all 0.3s ease;
+    }
+    button.primary:hover {
+        transform: translateY(-2px);
+        box-shadow: 0 6px 16px rgba(6, 182, 212, 0.4);
+    }
+    
+    /* Tab styling */
+    .tab-nav {
+        border-bottom: 2px solid rgba(148, 163, 184, 0.1);
+    }
+    
+    /* Role badge styling */
+    .role-badge {
+        display: inline-block;
+        padding: 6px 12px;
+        border-radius: 20px;
+        font-size: 12px;
+        font-weight: 600;
+        text-transform: uppercase;
+        letter-spacing: 0.5px;
+    }
+    .role-viewer {
+        background: linear-gradient(135deg, #64748b 0%, #475569 100%);
+        color: white;
+    }
+    .role-editor {
+        background: linear-gradient(135deg, #06b6d4 0%, #0891b2 100%);
+        color: white;
+    }
+    .role-admin {
+        background: linear-gradient(135deg, #8b5cf6 0%, #7c3aed 100%);
+        color: white;
+    }
+    .role-owner {
+        background: linear-gradient(135deg, #f59e0b 0%, #d97706 100%);
+        color: white;
+    }
+    
+    /* Improved input styling */
+    input[type="text"], textarea, select {
+        border-radius: 10px !important;
+        border: 2px solid rgba(148, 163, 184, 0.2) !important;
+        transition: all 0.3s ease !important;
+    }
+    input[type="text"]:focus, textarea:focus, select:focus {
+        border-color: #06b6d4 !important;
+        box-shadow: 0 0 0 3px rgba(6, 182, 212, 0.1) !important;
+    }
+    
+    /* Card styling for sections */
+    .section-card {
+        background: rgba(255, 255, 255, 0.02);
+        padding: 24px;
+        border-radius: 16px;
+        border: 1px solid rgba(148, 163, 184, 0.1);
+        margin-bottom: 20px;
+        backdrop-filter: blur(10px);
+    }
+    
+    /* Chatbot styling */
+    .chatbot {
+        border-radius: 12px !important;
+        border: 1px solid rgba(148, 163, 184, 0.2) !important;
     }
     """
 ) as demo:
-    gr.Markdown(
-        """
-        # 🤖 IntegraChat — MCP Autonomous Agent
-        
-        **Enterprise-grade AI with autonomous agents, secure multi-tenant RAG, real-time web search, and governance.**
-        
-        Enter your Tenant ID to chat with the MCP-powered agent or ingest documents into the enterprise knowledge base.
-        """
-    )
+    with gr.Column(elem_classes=["header-section"]):
+        gr.Markdown(
+            """
+            # 🤖 IntegraChat — MCP Autonomous Agent
+            
+            **Enterprise-grade AI with autonomous agents, secure multi-tenant RAG, real-time web search, and governance.**
+            """
+        )
+        gr.Markdown(
+            """
+            <div style="background: rgba(6, 182, 212, 0.1); padding: 16px; border-radius: 10px; border-left: 4px solid #06b6d4; margin-top: 16px;">
+            <strong>🔐 Role-Based Access Control:</strong> Features are automatically shown/hidden based on your role:
+            <ul style="margin: 8px 0 0 0; padding-left: 24px;">
+            <li><strong>👤 Viewer:</strong> Chat only</li>
+            <li><strong>✏️ Editor:</strong> Chat + Document Ingestion (no delete)</li>
+            <li><strong>🛡️ Admin/Owner:</strong> Full access to all features</li>
+            </ul>
+            </div>
+            """
+        )
     
-    tenant_id_input = gr.Textbox(
-        label="Tenant ID",
-        placeholder="Enter your tenant ID (e.g., tenant123)",
-        value="",
-        interactive=True
-    )
+    with gr.Row(elem_classes=["input-container"]):
+        tenant_id_input = gr.Textbox(
+            label="🏢 Tenant ID",
+            placeholder="Enter your tenant ID (e.g., tenant123)",
+            value="",
+            interactive=True,
+            scale=2,
+            info="Required for all operations"
+        )
+        role_input = gr.Dropdown(
+            label="👤 User Role",
+            choices=VALID_ROLES,
+            value=DEFAULT_ROLE,
+            interactive=True,
+            scale=1,
+            info="Select your role to access appropriate features"
+        )
     
     with gr.Tabs():
         with gr.Tab("Chat"):
-            with gr.Row():
-                with gr.Column(scale=2):
-                    chatbot = gr.Chatbot(
+            # Access denied for Editor role - Editor should only see Document Ingestion
+            chat_access_denied = gr.Markdown(
+                """
+                <div style="background: linear-gradient(135deg, rgba(239, 68, 68, 0.2) 0%, rgba(220, 38, 38, 0.2) 100%); padding: 40px; border-radius: 16px; border: 2px solid rgba(239, 68, 68, 0.4); text-align: center; margin: 20px 0;">
+                <h2 style="color: #fca5a5; margin-bottom: 16px;">🔒 Access Denied</h2>
+                <p style="color: #f1f5f9; font-size: 16px; margin-bottom: 12px;">
+                <strong>Editor role can only access Document Ingestion.</strong>
+                </p>
+                <p style="color: #cbd5e1; font-size: 14px;">
+                Please switch to Owner or Admin role to access Chat functionality, or go to the Document Ingestion tab.
+                </p>
+                </div>
+                """,
+                visible=False
+            )
+            
+            chat_content = gr.Column(visible=True)
+            
+            with chat_content:
+                with gr.Row():
+                    with gr.Column(scale=2):
+                        chatbot = gr.Chatbot(
                         label="Chat with Agent",
                         height=500,
                         show_label=True,
@@ -1131,24 +1406,29 @@ with gr.Blocks(
                 with gr.Column(scale=1):
                     gr.Markdown(
                         """
+                        <div style="background: linear-gradient(135deg, rgba(6, 182, 212, 0.1) 0%, rgba(59, 130, 246, 0.1) 100%); padding: 20px; border-radius: 12px; border: 1px solid rgba(6, 182, 212, 0.2);">
                         ### 📝 Chat Instructions
-                        1. Enter your **Tenant ID** above
+                        1. Enter your **Tenant ID** and **Role** above
                         2. Ask a question or give a task to the agent
                         3. The MCP agent will automatically select tools (RAG, Web, etc.)
                         
-                        ### ⚙️ Backend Configuration
-                        The agent connects to the FastAPI backend at `http://localhost:8000/agent/message`
+                        ### ⚡ Features
+                        - ✨ Real-time streaming responses
+                        - 🧠 Multi-step planning & reasoning
+                        - 🔍 Automatic tool selection
+                        - 💾 Conversation memory
+                        </div>
                         """
                     )
             
             # Event handlers for chat tab with streaming
-            def send_message(message, tenant_id, history):
+            def send_message(message, tenant_id, role, history):
                 # Clear message input immediately
                 message_input_value = ""
                 # Use streaming function which yields updates
                 # Gradio will automatically handle the generator and update UI in real-time
                 try:
-                    for updated_history in chat_with_agent(message, tenant_id, history):
+                    for updated_history in chat_with_agent(message, tenant_id, role, history):
                         yield updated_history, message_input_value
                 except Exception as e:
                     # Fallback if streaming fails
@@ -1158,24 +1438,44 @@ with gr.Blocks(
             
             send_button.click(
                 fn=send_message,
-                inputs=[message_input, tenant_id_input, chatbot],
+                inputs=[message_input, tenant_id_input, role_input, chatbot],
                 outputs=[chatbot, message_input]
             )
             
             message_input.submit(
                 fn=send_message,
-                inputs=[message_input, tenant_id_input, chatbot],
+                inputs=[message_input, tenant_id_input, role_input, chatbot],
                 outputs=[chatbot, message_input]
             )
+            
+            # Function to update Chat tab visibility based on role (Editor sees access denied)
+            def update_chat_visibility(role):
+                is_editor = role == "editor"
+                return (
+                    gr.update(visible=is_editor),      # Access denied message for Editor
+                    gr.update(visible=not is_editor),  # Chat content for Owner/Admin
+                )
+            
+            role_input.change(
+                fn=update_chat_visibility,
+                inputs=[role_input],
+                outputs=[chat_access_denied, chat_content]
+            )
         
-        with gr.Tab("Document Ingestion"):
+        with gr.Tab("📚 Document Ingestion"):
             gr.Markdown(
                 """
+                <div style="background: linear-gradient(135deg, rgba(16, 185, 129, 0.1) 0%, rgba(5, 150, 105, 0.1) 100%); padding: 20px; border-radius: 12px; border: 1px solid rgba(16, 185, 129, 0.2); margin-bottom: 20px;">
                 ### 📚 Knowledge Base Ingestion
                 Ingest documents so the MCP agent can reference tenant-private knowledge.
                 
-                - **Raw text / URLs:** Use the fields below.
-                - **Files (PDF, DOCX, TXT, MD):** Use the file upload section.
+                **📄 Supported Formats:**
+                - **Raw text / URLs:** Use the fields below
+                - **Files:** PDF, DOCX, TXT, Markdown
+                - **Metadata:** Optional JSON metadata for better organization
+                
+                **⚠️ Note:** Editor role and above can ingest. Admin/Owner can delete.
+                </div>
                 """
             )
             
@@ -1213,6 +1513,7 @@ with gr.Blocks(
             
             def handle_ingest_document(
                 tenant_id,
+                role,
                 mode,
                 content,
                 doc_url,
@@ -1223,6 +1524,7 @@ with gr.Blocks(
                 source_type = "raw_text" if mode == "Raw Text" else "url"
                 result = ingest_document(
                     tenant_id=tenant_id,
+                    role=role,
                     source_type=source_type,
                     content=content,
                     document_url=doc_url,
@@ -1239,6 +1541,7 @@ with gr.Blocks(
                 fn=handle_ingest_document,
                 inputs=[
                     tenant_id_input,
+                    role_input,
                     ingestion_mode,
                     doc_content,
                     document_url,
@@ -1257,8 +1560,8 @@ with gr.Blocks(
             )
             ingest_file_button = gr.Button("Upload & Ingest File", visible=False)
             
-            def handle_file_ingestion(tenant_id, file_obj):
-                result = ingest_file(tenant_id, file_obj)
+            def handle_file_ingestion(tenant_id, role, file_obj):
+                result = ingest_file(tenant_id, role, file_obj)
                 # Add note about refreshing Knowledge Base Library
                 if "✅" in result:
                     result += "\n\n💡 **Tip:** Go to the 'Knowledge Base Library' tab to view your ingested documents."
@@ -1266,7 +1569,7 @@ with gr.Blocks(
             
             ingest_file_button.click(
                 fn=handle_file_ingestion,
-                inputs=[tenant_id_input, file_upload],
+                inputs=[tenant_id_input, role_input, file_upload],
                 outputs=document_status
             )
 
@@ -1300,16 +1603,38 @@ with gr.Blocks(
                 ]
             )
         
-        with gr.Tab("Knowledge Base Library"):
-            gr.Markdown(
+        with gr.Tab("📖 Knowledge Base Library"):
+            # Access denied for Editor role
+            kb_access_denied = gr.Markdown(
                 """
-                ### 📚 Knowledge Base Library
+                <div style="background: linear-gradient(135deg, rgba(239, 68, 68, 0.2) 0%, rgba(220, 38, 38, 0.2) 100%); padding: 40px; border-radius: 16px; border: 2px solid rgba(239, 68, 68, 0.4); text-align: center; margin: 20px 0;">
+                <h2 style="color: #fca5a5; margin-bottom: 16px;">🔒 Access Denied</h2>
+                <p style="color: #f1f5f9; font-size: 16px; margin-bottom: 12px;">
+                <strong>Editor role can only access Document Ingestion.</strong>
+                </p>
+                <p style="color: #cbd5e1; font-size: 14px;">
+                Please switch to Owner or Admin role to access Knowledge Base Library.
+                </p>
+                </div>
+                """,
+                visible=False
+            )
+            
+            kb_library_content = gr.Column(visible=True)
+            
+            with kb_library_content:
+                gr.Markdown(
+                """
+                <div style="background: linear-gradient(135deg, rgba(139, 92, 246, 0.1) 0%, rgba(124, 58, 237, 0.1) 100%); padding: 20px; border-radius: 12px; border: 1px solid rgba(139, 92, 246, 0.2); margin-bottom: 20px;">
+                ### 📖 Knowledge Base Library
                 View, search, and manage all ingested documents for your tenant with visual analytics.
                 
+                **Features:**
                 - **📊 Statistics:** View document counts, types, and distribution
                 - **🔍 Search:** Use semantic search to find relevant documents
                 - **🔽 Filter:** Filter documents by type (text, PDF, FAQ, link)
-                - **🗑️ Delete:** Remove individual documents or delete all at once
+                - **🗑️ Delete:** Remove individual documents or delete all at once (Admin/Owner only)
+                </div>
                 """
             )
             
@@ -1367,8 +1692,9 @@ with gr.Blocks(
                 wrap=True
             )
             
-            # Delete Section
-            with gr.Row():
+            # Delete Section (Admin/Owner only)
+            kb_delete_section = gr.Row()
+            with kb_delete_section:
                 kb_delete_id = gr.Number(
                     label="Delete Document by ID",
                     value=None,
@@ -1380,8 +1706,16 @@ with gr.Blocks(
             
             kb_delete_status = gr.Markdown("")
             
-            def refresh_documents(tenant_id, filter_type="all"):
-                status, docs, total, stats, chart_fig = list_documents(tenant_id)
+            # Function to update KB tab visibility based on role
+            def update_kb_visibility(role):
+                can_delete = can_delete_documents(role)
+                return (
+                    gr.update(visible=can_delete),  # Delete all button
+                    gr.update(visible=can_delete),  # Delete section
+                )
+            
+            def refresh_documents(tenant_id, role, filter_type="all"):
+                status, docs, total, stats, chart_fig = list_documents(tenant_id, role)
                 
                 # Filter documents by type if not "all"
                 if filter_type != "all" and docs:
@@ -1405,28 +1739,28 @@ with gr.Blocks(
                     avg_length_md, chart_fig
                 )
             
-            def filter_documents(tenant_id, filter_type):
-                return refresh_documents(tenant_id, filter_type)
+            def filter_documents(tenant_id, role, filter_type):
+                return refresh_documents(tenant_id, role, filter_type)
             
-            def search_kb(tenant_id, query):
-                status, results = search_knowledge_base(tenant_id, query)
+            def search_kb(tenant_id, role, query):
+                status, results = search_knowledge_base(tenant_id, role, query)
                 return status, results
             
-            def delete_doc(tenant_id, doc_id):
+            def delete_doc(tenant_id, role, doc_id):
                 if doc_id is None or doc_id <= 0:
                     return "❗ Please enter a valid document ID.", "", "", "", "", "", "", "", None
-                result = delete_document(tenant_id, int(doc_id))
+                result = delete_document(tenant_id, role, int(doc_id))
                 # Refresh document list after deletion
-                return (result, *refresh_documents(tenant_id, "all"))
+                return (result, *refresh_documents(tenant_id, role, "all"))
             
-            def delete_all_docs(tenant_id):
-                result = delete_all_documents(tenant_id)
+            def delete_all_docs(tenant_id, role):
+                result = delete_all_documents(tenant_id, role)
                 # Refresh document list after deletion
-                return (result, *refresh_documents(tenant_id, "all"))
+                return (result, *refresh_documents(tenant_id, role, "all"))
             
             kb_refresh_button.click(
                 fn=refresh_documents,
-                inputs=[tenant_id_input, kb_filter_type],
+                inputs=[tenant_id_input, role_input, kb_filter_type],
                 outputs=[
                     kb_status, kb_documents_table, kb_total_docs, kb_text_docs, 
                     kb_pdf_docs, kb_faq_docs, kb_link_docs, kb_avg_length, kb_chart
@@ -1435,7 +1769,7 @@ with gr.Blocks(
             
             kb_filter_type.change(
                 fn=filter_documents,
-                inputs=[tenant_id_input, kb_filter_type],
+                inputs=[tenant_id_input, role_input, kb_filter_type],
                 outputs=[
                     kb_status, kb_documents_table, kb_total_docs, kb_text_docs, 
                     kb_pdf_docs, kb_faq_docs, kb_link_docs, kb_avg_length, kb_chart
@@ -1444,19 +1778,19 @@ with gr.Blocks(
             
             kb_search_button.click(
                 fn=search_kb,
-                inputs=[tenant_id_input, kb_search_query],
+                inputs=[tenant_id_input, role_input, kb_search_query],
                 outputs=[kb_search_status, kb_search_results]
             )
             
             kb_search_query.submit(
                 fn=search_kb,
-                inputs=[tenant_id_input, kb_search_query],
+                inputs=[tenant_id_input, role_input, kb_search_query],
                 outputs=[kb_search_status, kb_search_results]
             )
             
             kb_delete_button.click(
                 fn=delete_doc,
-                inputs=[tenant_id_input, kb_delete_id],
+                inputs=[tenant_id_input, role_input, kb_delete_id],
                 outputs=[
                     kb_delete_status, kb_status, kb_documents_table, kb_total_docs, 
                     kb_text_docs, kb_pdf_docs, kb_faq_docs, kb_link_docs, kb_avg_length, kb_chart
@@ -1465,167 +1799,252 @@ with gr.Blocks(
             
             kb_delete_all_button.click(
                 fn=delete_all_docs,
-                inputs=[tenant_id_input],
+                inputs=[tenant_id_input, role_input],
                 outputs=[
                     kb_delete_status, kb_status, kb_documents_table, kb_total_docs, 
                     kb_text_docs, kb_pdf_docs, kb_faq_docs, kb_link_docs, kb_avg_length, kb_chart
                 ]
             )
+            
+            # Update visibility when role changes
+            def update_kb_full_visibility(role):
+                is_editor = role == "editor"
+                can_delete = can_delete_documents(role)
+                return (
+                    gr.update(visible=is_editor),      # Access denied for Editor
+                    gr.update(visible=not is_editor),  # KB content for Owner/Admin
+                    gr.update(visible=can_delete),     # Delete all button
+                    gr.update(visible=can_delete),     # Delete section
+                )
+            
+            role_input.change(
+                fn=update_kb_full_visibility,
+                inputs=[role_input],
+                outputs=[kb_access_denied, kb_library_content, kb_delete_all_button, kb_delete_section]
+            )
         
-        with gr.Tab("Admin Analytics"):
-            gr.Markdown(
-                """
-                # 📊 Admin Analytics Dashboard
-                
-                Comprehensive tenant-level analytics with visual insights, performance metrics, and detailed tool usage statistics.
+        with gr.Tab("📊 Admin Analytics"):
+            # Access denied message for non-admin/owner roles
+            analytics_access_denied = gr.Markdown(
                 """
+                <div style="background: linear-gradient(135deg, rgba(239, 68, 68, 0.2) 0%, rgba(220, 38, 38, 0.2) 100%); padding: 40px; border-radius: 16px; border: 2px solid rgba(239, 68, 68, 0.4); text-align: center; margin: 20px 0;">
+                <h2 style="color: #fca5a5; margin-bottom: 16px;">🔒 Access Denied</h2>
+                <p style="color: #f1f5f9; font-size: 16px; margin-bottom: 12px;">
+                <strong>You need Admin or Owner role to access Analytics Dashboard.</strong>
+                </p>
+                <p style="color: #cbd5e1; font-size: 14px;">
+                Analytics features are restricted to administrative roles for data security and privacy.
+                </p>
+                </div>
+                """,
+                visible=False
             )
             
-            # Refresh Button at Top
-            with gr.Row():
-                analytics_refresh = gr.Button("🔄 Fetch Analytics Snapshot", variant="primary", size="lg")
-                gr.Markdown("")
-            
-            # Statistics Cards
-            gr.Markdown("### 📈 Key Metrics")
-            with gr.Row():
-                analytics_total_queries = gr.Markdown("### 📊 Total Queries\n**0**", elem_classes=["stat-card"])
-                analytics_active_users = gr.Markdown("### 👥 Active Users\n**0**", elem_classes=["stat-card"])
-                analytics_redflags = gr.Markdown("### 🚩 Red Flags\n**0**", elem_classes=["stat-card"])
-                analytics_rag_searches = gr.Markdown("### 🔍 RAG Searches\n**0**", elem_classes=["stat-card"])
-            
-            # Charts Section
-            gr.Markdown("### 📊 Performance Charts")
-            with gr.Row():
-                with gr.Column(scale=1):
-                    gr.Markdown("#### 📈 Tool Usage Count", elem_classes=["chart-title"])
-                    analytics_tool_chart = gr.Plot(label="", show_label=False)
-                with gr.Column(scale=1):
-                    gr.Markdown("#### ⚡ Average Tool Latency", elem_classes=["chart-title"])
-                    analytics_latency_chart = gr.Plot(label="", show_label=False)
+            # Analytics content (visible for admin/owner)
+            analytics_content = gr.Column(visible=True)
             
-            # RAG Quality and Summary Section
-            with gr.Row():
-                with gr.Column(scale=1):
-                    gr.Markdown("#### 🔍 RAG Quality Metrics", elem_classes=["chart-title"])
-                    analytics_rag_chart = gr.Plot(label="", show_label=False)
+            with analytics_content:
+                gr.Markdown(
+                    """
+                    <div style="background: linear-gradient(135deg, rgba(245, 158, 11, 0.1) 0%, rgba(217, 119, 6, 0.1) 100%); padding: 24px; border-radius: 12px; border: 1px solid rgba(245, 158, 11, 0.2); margin-bottom: 20px;">
+                    # 📊 Admin Analytics Dashboard
+                    
+                    Comprehensive tenant-level analytics with visual insights, performance metrics, and detailed tool usage statistics.
+                    
+                    **🔒 Access:** Admin and Owner roles only
+                    </div>
+                    """
+                )
                 
-                with gr.Column(scale=1):
-                    gr.Markdown("### 📋 Analytics Summary")
-                    analytics_summary = gr.Markdown(
-                        "👉 Click **Fetch Analytics Snapshot** to load data.",
-                        elem_classes=["summary-box"]
-                    )
-            
-            # Tool Usage Details Table
-            gr.Markdown("### 🔧 Detailed Tool Usage")
-            analytics_tool_table = gr.Dataframe(
-                headers=["Tool", "Count", "Avg Latency (ms)", "Success", "Errors", "Total Tokens"],
-                datatype=["str", "number", "number", "number", "number", "number"],
-                interactive=False,
-                label="",
-                wrap=True
-            )
-            
-            analytics_error = gr.Markdown("", visible=False)
-            
-            def format_analytics(tenant_id):
-                summary, tool_usage, tool_chart, latency_chart, rag_chart, error = fetch_admin_analytics(tenant_id)
+                # Refresh Button at Top
+                with gr.Row():
+                    analytics_refresh = gr.Button("🔄 Fetch Analytics Snapshot", variant="primary", size="lg")
+                    gr.Markdown("")
+            
+                # Statistics Cards
+                gr.Markdown("### 📈 Key Metrics")
+                with gr.Row():
+                    analytics_total_queries = gr.Markdown("### 📊 Total Queries\n**0**", elem_classes=["stat-card"])
+                    analytics_active_users = gr.Markdown("### 👥 Active Users\n**0**", elem_classes=["stat-card"])
+                    analytics_redflags = gr.Markdown("### 🚩 Red Flags\n**0**", elem_classes=["stat-card"])
+                    analytics_rag_searches = gr.Markdown("### 🔍 RAG Searches\n**0**", elem_classes=["stat-card"])
                 
-                if error:
-                    return (
-                        error, "", "", "", "", None, None, None, []
-                    )
+                # Charts Section
+                gr.Markdown("### 📊 Performance Charts")
+                with gr.Row():
+                    with gr.Column(scale=1):
+                        gr.Markdown("#### 📈 Tool Usage Count", elem_classes=["chart-title"])
+                        analytics_tool_chart = gr.Plot(label="", show_label=False)
+                    with gr.Column(scale=1):
+                        gr.Markdown("#### ⚡ Average Tool Latency", elem_classes=["chart-title"])
+                        analytics_latency_chart = gr.Plot(label="", show_label=False)
                 
-                # Extract overview data - fetch_admin_analytics already fetched it, but we need it again for cards
-                overview_data = {}
-                try:
-                    resp = requests.get(
-                        f"{BACKEND_BASE_URL}/analytics/overview",
-                        headers={"x-tenant-id": tenant_id},
-                        timeout=30
-                    )
-                    if resp.status_code == 200:
-                        data = resp.json()
-                        # The API returns {"overview": {...}} or direct overview object
-                        overview_data = data.get("overview", data) if isinstance(data, dict) else {}
-                        # Debug: print to see what we're getting
-                        print(f"DEBUG: Overview data keys: {overview_data.keys() if isinstance(overview_data, dict) else 'Not a dict'}")
-                except Exception as e:
-                    print(f"Error fetching overview: {e}")
-                    pass
+                # RAG Quality and Summary Section
+                with gr.Row():
+                    with gr.Column(scale=1):
+                        gr.Markdown("#### 🔍 RAG Quality Metrics", elem_classes=["chart-title"])
+                        analytics_rag_chart = gr.Plot(label="", show_label=False)
+                    
+                    with gr.Column(scale=1):
+                        gr.Markdown("### 📋 Analytics Summary")
+                        analytics_summary = gr.Markdown(
+                            "👉 Click **Fetch Analytics Snapshot** to load data.",
+                            elem_classes=["summary-box"]
+                        )
                 
-                # Extract values with proper fallbacks - handle both nested and flat structures
-                if isinstance(overview_data, dict):
-                    total_queries = overview_data.get("total_queries", 0)
-                    active_users = overview_data.get("active_users", 0)
-                    redflag_count = overview_data.get("redflag_count", 0)
-                    rag_quality = overview_data.get("rag_quality", {})
-                    rag_searches = rag_quality.get("total_searches", 0) if isinstance(rag_quality, dict) else 0
-                else:
-                    total_queries = 0
-                    active_users = 0
-                    redflag_count = 0
-                    rag_quality = {}
-                    rag_searches = 0
+                # Tool Usage Details Table
+                gr.Markdown("### 🔧 Detailed Tool Usage")
+                analytics_tool_table = gr.Dataframe(
+                    headers=["Tool", "Count", "Avg Latency (ms)", "Success", "Errors", "Total Tokens"],
+                    datatype=["str", "number", "number", "number", "number", "number"],
+                    interactive=False,
+                    label="",
+                    wrap=True
+                )
                 
-                # Format statistics cards
-                queries_md = f"### 📊 Total Queries\n**{total_queries}**"
-                users_md = f"### 👥 Active Users\n**{active_users}**"
-                redflags_md = f"### 🚩 Red Flags\n**{redflag_count}**"
-                rag_md = f"### 🔍 RAG Searches\n**{rag_searches}**"
+                analytics_error = gr.Markdown("", visible=False)
                 
-                # Format tool usage table
-                tool_table_data = []
-                for tool_name, stats in tool_usage.items():
-                    tool_table_data.append({
-                        "Tool": tool_name.replace(".", " ").title(),
-                        "Count": stats.get("count", 0),
-                        "Avg Latency (ms)": round(stats.get("avg_latency_ms", 0), 2),
-                        "Success": stats.get("success_count", 0),
-                        "Errors": stats.get("error_count", 0),
-                        "Total Tokens": stats.get("total_tokens", 0)
-                    })
+                def format_analytics(tenant_id, role):
+                    summary, tool_usage, tool_chart, latency_chart, rag_chart, error = fetch_admin_analytics(tenant_id, role)
+                    
+                    if error:
+                        return (
+                            error, "", "", "", "", None, None, None, []
+                        )
+                    
+                    # Extract overview data - fetch_admin_analytics already fetched it, but we need it again for cards
+                    overview_data = {}
+                    try:
+                        headers = {
+                            "x-tenant-id": tenant_id,
+                            "x-user-role": role if role else DEFAULT_ROLE
+                        }
+                        resp = requests.get(
+                            f"{BACKEND_BASE_URL}/analytics/overview",
+                            headers=headers,
+                            timeout=30
+                        )
+                        if resp.status_code == 200:
+                            data = resp.json()
+                            # The API returns {"overview": {...}} or direct overview object
+                            overview_data = data.get("overview", data) if isinstance(data, dict) else {}
+                            # Debug: print to see what we're getting
+                            print(f"DEBUG: Overview data keys: {overview_data.keys() if isinstance(overview_data, dict) else 'Not a dict'}")
+                    except Exception as e:
+                        print(f"Error fetching overview: {e}")
+                        pass
+                    
+                    # Extract values with proper fallbacks - handle both nested and flat structures
+                    if isinstance(overview_data, dict):
+                        total_queries = overview_data.get("total_queries", 0)
+                        active_users = overview_data.get("active_users", 0)
+                        redflag_count = overview_data.get("redflag_count", 0)
+                        rag_quality = overview_data.get("rag_quality", {})
+                        rag_searches = rag_quality.get("total_searches", 0) if isinstance(rag_quality, dict) else 0
+                    else:
+                        total_queries = 0
+                        active_users = 0
+                        redflag_count = 0
+                        rag_quality = {}
+                        rag_searches = 0
+                    
+                    # Format statistics cards
+                    queries_md = f"### 📊 Total Queries\n**{total_queries}**"
+                    users_md = f"### 👥 Active Users\n**{active_users}**"
+                    redflags_md = f"### 🚩 Red Flags\n**{redflag_count}**"
+                    rag_md = f"### 🔍 RAG Searches\n**{rag_searches}**"
+                    
+                    # Format tool usage table
+                    tool_table_data = []
+                    for tool_name, stats in tool_usage.items():
+                        tool_table_data.append({
+                            "Tool": tool_name.replace(".", " ").title(),
+                            "Count": stats.get("count", 0),
+                            "Avg Latency (ms)": round(stats.get("avg_latency_ms", 0), 2),
+                            "Success": stats.get("success_count", 0),
+                            "Errors": stats.get("error_count", 0),
+                            "Total Tokens": stats.get("total_tokens", 0)
+                        })
+                    
+                    return (
+                        summary, queries_md, users_md, redflags_md, rag_md,
+                        tool_chart, latency_chart, rag_chart, tool_table_data
+                    )
                 
+                analytics_refresh.click(
+                    fn=format_analytics,
+                    inputs=[tenant_id_input, role_input],
+                    outputs=[
+                        analytics_summary,
+                        analytics_total_queries,
+                        analytics_active_users,
+                        analytics_redflags,
+                        analytics_rag_searches,
+                        analytics_tool_chart,
+                        analytics_latency_chart,
+                        analytics_rag_chart,
+                        analytics_tool_table
+                    ]
+                )
+            
+            # Function to update Analytics tab visibility based on role (Editor sees access denied)
+            def update_analytics_visibility(role):
+                is_editor = role == "editor"
+                has_access = can_view_analytics(role)
                 return (
-                    summary, queries_md, users_md, redflags_md, rag_md,
-                    tool_chart, latency_chart, rag_chart, tool_table_data
+                    gr.update(visible=is_editor or not has_access),  # Access denied for Editor or non-admin
+                    gr.update(visible=has_access and not is_editor), # Analytics content for Admin/Owner only
                 )
             
-            analytics_refresh.click(
-                fn=format_analytics,
-                inputs=[tenant_id_input],
-                outputs=[
-                    analytics_summary,
-                    analytics_total_queries,
-                    analytics_active_users,
-                    analytics_redflags,
-                    analytics_rag_searches,
-                    analytics_tool_chart,
-                    analytics_latency_chart,
-                    analytics_rag_chart,
-                    analytics_tool_table
-                ]
+            # Update visibility when role changes
+            role_input.change(
+                fn=update_analytics_visibility,
+                inputs=[role_input],
+                outputs=[analytics_access_denied, analytics_content]
             )
+            
         
-        with gr.Tab("Admin Rules & Compliance"):
-            gr.Markdown(
-                """
-                ### 🛡️ Admin Rules & Regulations
-                Upload or manage tenant-specific governance rules (red-flag patterns, compliance policies, etc.).
-                
-                **Upload Methods:**
-                - **Text Input:** Enter one rule per line in the text box
-                - **File Upload:** Upload rules from TXT, PDF, DOC, or DOCX files
-                
-                **Features:**
-                - Rules are automatically enhanced by LLM (identifies edge cases, improves patterns)
-                - Comment lines (starting with #) are automatically ignored
-                - Use the delete box to remove an exact rule
-                - Refresh anytime to view the latest rule set
+        with gr.Tab("🛡️ Admin Rules & Compliance"):
+            # Access denied for Editor role
+            rules_access_denied = gr.Markdown(
                 """
+                <div style="background: linear-gradient(135deg, rgba(239, 68, 68, 0.2) 0%, rgba(220, 38, 38, 0.2) 100%); padding: 40px; border-radius: 16px; border: 2px solid rgba(239, 68, 68, 0.4); text-align: center; margin: 20px 0;">
+                <h2 style="color: #fca5a5; margin-bottom: 16px;">🔒 Access Denied</h2>
+                <p style="color: #f1f5f9; font-size: 16px; margin-bottom: 12px;">
+                <strong>Editor role can only access Document Ingestion.</strong>
+                </p>
+                <p style="color: #cbd5e1; font-size: 14px;">
+                Admin Rules & Compliance is restricted to Admin and Owner roles only.
+                </p>
+                </div>
+                """,
+                visible=False
             )
             
+            rules_content = gr.Column(visible=True)
+            
+            with rules_content:
+                gr.Markdown(
+                    """
+                    <div style="background: linear-gradient(135deg, rgba(239, 68, 68, 0.1) 0%, rgba(220, 38, 38, 0.1) 100%); padding: 20px; border-radius: 12px; border: 1px solid rgba(239, 68, 68, 0.2); margin-bottom: 20px;">
+                    ### 🛡️ Admin Rules & Regulations
+                    Upload or manage tenant-specific governance rules (red-flag patterns, compliance policies, etc.).
+                    
+                    **📤 Upload Methods:**
+                    - **Text Input:** Enter one rule per line in the text box
+                    - **File Upload:** Upload rules from TXT, PDF, DOC, or DOCX files
+                    
+                    **✨ Features:**
+                    - 🤖 Rules are automatically enhanced by LLM (identifies edge cases, improves patterns)
+                    - 💬 Comment lines (starting with #) are automatically ignored
+                    - 🗑️ Use the delete box to remove an exact rule
+                    - 🔄 Refresh anytime to view the latest rule set
+                    
+                    **🔒 Access:** Admin and Owner roles only
+                    </div>
+                    """
+                )
+            
             rules_summary = gr.Markdown("👉 Click **Refresh Rules** to see existing entries.")
             rules_table = gr.Dataframe(
                 headers=["#", "Rule"],
@@ -1665,32 +2084,53 @@ with gr.Blocks(
             
             refresh_rules_button.click(
                 fn=fetch_admin_rules,
-                inputs=[tenant_id_input],
+                inputs=[tenant_id_input, role_input],
                 outputs=[rules_summary, rules_table]
             )
             
             upload_rules_button.click(
                 fn=add_rules_and_refresh,
-                inputs=[tenant_id_input, rules_input],
+                inputs=[tenant_id_input, role_input, rules_input],
                 outputs=[rules_status, rules_summary, rules_table]
             )
             
             upload_file_button.click(
                 fn=add_rules_from_file,
-                inputs=[tenant_id_input, rules_file_upload],
+                inputs=[tenant_id_input, role_input, rules_file_upload],
                 outputs=[rules_status, rules_summary, rules_table]
             )
             
             delete_rule_button.click(
                 fn=delete_rule_and_refresh,
-                inputs=[tenant_id_input, delete_rule_input],
+                inputs=[tenant_id_input, role_input, delete_rule_input],
                 outputs=[rules_status, rules_summary, rules_table]
             )
+            
+            # Function to update Admin Rules tab visibility based on role
+            def update_rules_visibility(role):
+                is_editor = role == "editor"
+                has_access = can_manage_rules(role)
+                return (
+                    gr.update(visible=is_editor or not has_access),  # Access denied for Editor or non-admin
+                    gr.update(visible=has_access and not is_editor), # Rules content for Admin/Owner only
+                )
+            
+            role_input.change(
+                fn=update_rules_visibility,
+                inputs=[role_input],
+                outputs=[rules_access_denied, rules_content]
+            )
     
     gr.Markdown(
         """
-        ---
-        **Built with [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) for the MCP Hackathon**
+        <div style="margin-top: 40px; padding: 24px; background: linear-gradient(135deg, rgba(15, 23, 42, 0.5) 0%, rgba(30, 41, 59, 0.5) 100%); border-radius: 12px; border: 1px solid rgba(148, 163, 184, 0.1); text-align: center;">
+        <p style="margin: 0; color: #94a3b8; font-size: 14px;">
+        Built with ❤️ using <a href="https://modelcontextprotocol.io/" target="_blank" style="color: #06b6d4; text-decoration: none; font-weight: 600;">Model Context Protocol (MCP)</a>
+        </p>
+        <p style="margin: 8px 0 0 0; color: #64748b; font-size: 12px;">
+        Enterprise-Grade MCP Autonomous Agent Platform
+        </p>
+        </div>
         """
     )