Users, groups and roles

Who has access and what they may do is decided in three places: at the account, at the role and at the group. This page describes what is available to you as an administrator for that.

Accounts

The user list shows all accounts with role, sign-in method, status, last activity and their share of usage. From there you reach everything else about a person: view usage, view access, export data, change role, top up credit, block and delete.

No minute by minute monitoring

Activity is shown to the day, not to the minute. That is a deliberate design decision: for the question “is the tool being used at all”, the day is enough; for performance monitoring the figure is deliberately useless.

Taking people on

There are two routes:

• Inviting is the normal one. The invited person sets their own password, you never have to transmit one. Invitations expire and are valid only for the address given. Optionally the person is added automatically to one or more groups on registration.
• Creating directly produces an account without registration, including role and groups. An initial password can be generated and put into the clipboard, so that it does not end up in screenshots or in browser autofill.

For an invitation to work, the email domain has to match the domains permitted for registration. If mail delivery is set up, an email goes out as well; otherwise you send the invitation link yourself.

Roles and permissions

Roles bundle permissions. Next to the two system roles for users and administrators you can create roles of your own. The permissions are grouped by topic:

Group	What it covers
Tools	Web search, code interpreter, file search and citations, access to connectors
Chat features	Parallel answers, temporary chats, bookmarks, memories
Creating and sharing	Agents, prompts, skills and shared links
Remote agents	Agents outside the chat, for example in the Outlook add-in
Visibility	whether users and groups appear in the sharing dialog

In addition you define per role which model cards are visible, see Models and model cards.

Careful with the administrator role

Changes to the administrator role affect your own account too and apply immediately to all administrators. There is no exception for the person flipping the switch. So check such changes twice.

Never roll out skills to everyone

Skills are stored standard processes. Grant them deliberately instead of opening them up to everyone.

Groups

Groups are the basis for access and model selection. They are either maintained locally in the panel or come from your identity provider; in that case they are read only and their members are managed by the identity provider.

Per group you can define which connectors are permitted and which model cards are visible. The principle: the narrower rule wins.

Blocking and deleting

A block is either time limited or indefinite and can be lifted again at any time.

Deleting an account removes the account, conversations, messages, files, keys, agents and credit balance, and cannot be undone. The dialog therefore requires an explicit confirmation and offers the data export right before it: after deletion no disclosure can be given any more, so the disclosure required by the GDPR has to happen beforehand. Optionally the usage transactions are deleted as well; the billing receipt is then lost. More on that under Data protection and retention.

“What may this person do, and why”

For every person there is an overview of their access: role, groups, permitted connectors, visible model cards and agent grants. Each entry states which level made the decision, and the route there is linked. That is the fastest way when somebody reports that they cannot see a connector or a model.