Users and the Acting User
The Rule Repository records who did everything: who created a rule, who changed a version, who made it live, who ran a test, who wrote a note. It has no user directory and no sign-in of its own, so it learns who the user is from your application on every request, through the configuration's acting user properties.
You need to set them correctly because they are the repository's whole audit trail. Whatever your application puts in them is what the history shows.
The Properties
| Property |
What to put in it |
CurrentUserId |
Required on every request. The user's ID in your application: a login name, an email address, a directory object ID. Up to 256 characters. Never shown on screen. |
CurrentUserName |
The name RR shows for that user. Optional. |
CurrentUserType |
UserType.User (a person, the default), UserType.Agent (an AI agent acting on its own) or UserType.Service (automation with no person behind it). |
CurrentAgentId |
The ID of an AI agent acting for the person in CurrentUserId, or null. |
CurrentAgentName |
That agent's display name. Optional, and only with CurrentAgentId. |
var config = new Configuration
{
CurrentUserId = user.FindFirst(ClaimTypes.NameIdentifier)?.Value, // from your sign-in, never from the request
CurrentUserName = user.FindFirst(ClaimTypes.Name)?.Value
};
How RR Stores Users
- On first use. An ID RR has not seen before is a new user: it is stored the first time it arrives, on the page's first request or on the first change it makes, and appears from then on in every "Created By" and "Modified By" list.
- Your application is responsible for the ID being right. RR has nothing to check an ID against. A mistyped or changed ID does not cause an error; it creates another user. Use an ID that never changes for a person (a directory object ID is better than an email address that may change with a name).
- Names follow your application. When
CurrentUserName is set and differs from the stored name, RR updates it, so a renamed person shows under the new name from their next visit. When you leave it out, the stored name is kept.
- The ID is never shown. A user without a name appears as "- no name -". A change made by RR itself, such as a source synchronization nobody is named for, appears as "System".
- IDs must be unique across people, agents and services. One ID is one user, whatever its type. Identity providers such as Microsoft Entra ID already give users and applications IDs from one space.
People, Agents and Services
Everything that acts on the repository is a user of one of three types. The type decides what the user may ever do, on top of the permissions you give:
| Who is calling |
CurrentUserType |
CurrentAgentId |
Credited with the work |
| A person in the browser |
User |
null |
The person |
| A person through an AI agent (an AI client connected to your MCP server, or RR's own AI Assistant) |
User |
the agent's ID |
The person; every history entry also names the agent |
| An AI agent on its own (no person) |
Agent |
null |
The agent |
| A job, a pipeline, another system |
Service |
null |
The service |
Only a person can make a version live, take one offline, approve or decline a request, or delete. These permissions are removed from the effective set of any request made by an agent, a service, or a person acting through an agent, whatever you grant. An agent's or a service's save always requests approval, so a person decides what goes into production.
Set CurrentUserType and CurrentAgentId only from your own authentication of the caller (for example, the client an access token was issued to), never from anything the caller says about itself: an agent can call itself whatever it likes.
The rules RR checks before it writes anything:
| Control number |
Problem |
| CE10166 |
CurrentUserType is not User, Agent or Service. |
| CE10167 |
An agent ID with a user that is not a person, or an agent ID equal to CurrentUserId. |
| CE10168 |
An agent name without an agent ID. |
| CE10169 |
An agent ID longer than 256 characters. (Names are trimmed and cut to 256, not refused.) |
RR's Own AI Assistant
When a user works through RR's AI Assistant or AI Rule Editor, the repository itself sets the agent: the request is the person's, with an agent whose ID is rr-assistant and whose name is "AI Assistant", unless you change them with AssistantSettings.AgentId and AgentName. Do not give any of your users the ID rr-assistant. See AI Assistant and AI Rule Editor.
Users in Source Synchronization
Context.SyncSources is your application's own call, made without a browser request. To credit a synchronization to someone (a deployment pipeline, an administrator who pressed a button), set SourceSettings.UserId, UserName and UserType; left empty, the new source versions are credited to "System". See Source Sync and Versioning.
Removing or Renaming People
RR never deletes a user record, because the history must stay true. To change how a person appears, send the new CurrentUserName. If a person leaves, simply stop letting them sign in; their past work stays credited to them.