feat(docs): add details on custom model fine-tuning roles and permissions

Author: rstrahan

CHANGELOG.md

@@ -204,7 +204,7 @@ SPDX-License-Identifier: MIT-0
 
 - **Discovery accessible from CLI and SDK** — Discovery can now be run programmatically via the IDP SDK (`client.discovery.run()`) and CLI (`idp-cli discover`), enabling users with many document classes to automate schema generation without the Web UI. Supports both modes: without ground truth (exploratory) and with ground truth (optimized). ([#228](https://github.com/aws-solutions-library-samples/accelerated-intelligent-document-processing-on-aws/issues/228))
 
-- **Custom Model Fine-tuning** — Fine-tune Amazon Nova models using processed IDP documents directly from the Web UI. Create a fine-tuning job from a Test Set (which provides documents with ground truth data), generate training data in JSONL format, submit fine-tuning jobs to Bedrock, and deploy the resulting custom models for use in extraction workflows. See [Custom Model Fine-tuning](./docs/custom-model-finetuning.md) for details.
+- **Custom Model Fine-tuning** — Improve extraction and classification accuracy for your specific document types by fine-tuning Amazon Nova models on your own labeled data — no ML expertise required. Select a Test Set with ground truth, choose a base model, and the system handles training data generation, Bedrock fine-tuning, and on-demand model deployment automatically. Custom models are billed pay-per-token with no idle costs. Available to Admin and Author roles. See [Custom Model Fine-tuning](./docs/custom-model-finetuning.md) for details.
   - **Web UI**: New "Custom Models" page with job creation form (test set selector, base model selector, train/validation split), jobs table with status tracking, and detailed job view with deployment status and configuration version creation
   - **CLI / SDK**: `idp-cli finetuning create`, `idp-cli finetuning status`, `idp-cli finetuning list`, `idp-cli finetuning delete` commands for programmatic job management
   - **GraphQL API**: New `createFinetuningJob`, `getFinetuningJob`, `listFinetuningJobs`, `deleteFinetuningJob` mutations/queries with `FinetuningJob` type and real-time status fields

docs/custom-model-finetuning.md

@@ -28,13 +28,20 @@ flowchart LR
 5. **Deploy Endpoint**: The trained model is deployed as an on-demand Custom Model Deployment
 6. **Use in Configuration**: Select the custom model when creating or editing configurations
 
+## Roles & Permissions
+
+Custom Model Fine-tuning is available to **Admin** and **Author** roles. The GraphQL mutations (`createFinetuningJob`, `deleteFinetuningJob`) are enforced server-side via AppSync `@aws_auth` directives, so Reviewer and Viewer roles cannot create or delete jobs even via direct API calls. The query APIs (`listFinetuningJobs`, `getFinetuningJob`, `listAvailableModels`) are accessible to all authenticated users at the schema level, but the UI only exposes the Custom Models page to Admin and Author.
+
+> **Note on config-version scoping**: Fine-tuning jobs are currently global — they are not filtered by `allowedConfigVersions`. A scoped Author can see all fine-tuning jobs and create jobs from any test set. However, when applying a custom model to a configuration version (via "Create Config Version"), the config-version scope is enforced — the Author can only target versions within their scope. See [RBAC](./rbac.md) for the full permission matrix.
+
 ## Prerequisites
 
 - An existing Test Set with:
   - At least 10 documents
   - At least 2 document classes
   - Baseline classifications for all documents
 - Appropriate IAM permissions for Bedrock model customization
+- **Admin** or **Author** role in the IDP Accelerator
 
 ## Using the UI
 

docs/rbac.md

@@ -67,6 +67,12 @@ TEST STUDIO
   View/run test sets              ✅      ✅       ❌        ❌
   Create/delete test sets         ✅      ✅       ❌        ❌
 
+CUSTOM MODEL FINE-TUNING
+  List/view fine-tuning jobs      ✅      ✅       ❌        ❌
+  Create fine-tuning jobs         ✅      ✅       ❌        ❌
+  Delete fine-tuning jobs         ✅      ✅       ❌        ❌
+  List available models           ✅      ✅       ❌        ❌
+
 CAPACITY PLANNING
   Calculate capacity              ✅      ✅       ❌        ✅
 
@@ -178,6 +184,7 @@ Every GraphQL **mutation** and many **queries** have `@aws_auth(cognito_groups:
 | `startTestRun`, `addTestSet`, `addTestSetFromUpload`, `deleteTests`, `deleteTestSets` | Admin, Author |
 | `syncBdaIdp`, `uploadDiscoveryDocument`, `deleteDiscoveryJob`, `autoDetectSections` | Admin, Author |
 | `copyToBaseline` | Admin, Author |
+| `createFinetuningJob`, `deleteFinetuningJob` | Admin, Author |
 | `processChanges`, `completeSectionReview`, `claimReview`, `releaseReview`, `skipAllSectionsReview` | Admin, Reviewer |
 | `sendAgentChatMessage`, `deleteChatSession`, `updateChatSessionTitle`, `deleteAgentJob` | All authenticated users (see note below) |
 | `updateAgentChatMessage` | All authenticated users (also IAM for backend) |
@@ -196,6 +203,7 @@ Every GraphQL **mutation** and many **queries** have `@aws_auth(cognito_groups:
 | `listConfigurationLibrary`, `getConfigurationLibraryFile` | Admin, Author, Viewer |
 | `listDiscoveryJobs` | Admin, Author |
 | `getTestRun`, `getTestRuns`, `getTestRunStatus`, `compareTestRuns`, `getTestSets`, `listBucketFiles`, `validateTestFileName` | Admin, Author |
+| `listFinetuningJobs`, `getFinetuningJob`, `validateTestSetForFinetuning`, `listAvailableModels` | All authenticated (UI limited to Admin, Author) |
 | `queryKnowledgeBase`, `chatWithDocument` | All authenticated |
 | `listUsers` | All authenticated (non-admin sees only self in resolver) |
 | `getMyProfile` | All authenticated |
@@ -295,4 +303,5 @@ To add a new role:
 - **Knowledge Base queries** do not currently enforce config-version scope. KB results may include documents from out-of-scope config versions.
 - **Agent Companion Chat** analytics queries (Athena) do not filter by config-version scope.
 - **GetDocument API** (direct document access by URL) does not enforce config-version scope at the resolver level. UI navigation hides out-of-scope documents, but direct API access is not blocked.
+- **Custom Model Fine-tuning** jobs are global — not scoped by `allowedConfigVersions`. A scoped Author can see all fine-tuning jobs and create jobs from any test set. However, when applying a custom model to a configuration version (via the "Create Config Version" modal), the config-version scope IS enforced — the Author can only target versions within their scope.
 - These limitations are tracked for Phase 3 implementation.

src/ui/src/components/genaiidp-layout/navigation.tsx

@@ -80,6 +80,7 @@ export const authorNavItems = [
     items: [
       { type: 'link', text: 'View/Edit Configuration', href: `#${CONFIGURATION_PATH}` },
       { type: 'link', text: 'Discovery', href: `#${DISCOVERY_PATH}` },
+      { type: 'link', text: 'Custom Models', href: `#${CUSTOM_MODELS_PATH}` },
       { type: 'link', text: 'Capacity Planning', href: `#${CAPACITY_PLANNING_PATH}` },
       { type: 'link', text: 'View Pricing', href: `#${PRICING_PATH}` },
     ],