Groups and Profiles
Permissions are organised in three levels, from the finest to the broadest:
permission → profile → group → user
"write a KB" "Pipeline "Manager"
creation"
- A permission is an elementary right, expressed as a resource and an action: read pipelines, write knowledge bases, run an indexing pass. The list is fixed by the application; it cannot be edited.
- A profile is a named bundle of permissions. It maps to a job: "Pipeline creation", "Team management", "System configuration".
- A group bundles several profiles. It is the only object assigned to a user, and each user holds exactly one.
An account's effective permissions are the union of those of every profile in its group.
:::note One implicit rule only Ticking Write on a resource always grants Read on the same resource: whoever can modify can consult. No other permission implies another — in particular, Execute implies nothing. :::
The four groups shipped
Every organization starts with four ready-to-use groups. They are fully editable: rename them, add profiles to them, or create your own.
| Group | Profiles included | For whom |
|---|---|---|
| Document checking | Document checking | The business user: submits documents and reads annotations. |
| Manager | Document checking + Pipeline creation + Team management | Builds pipelines and runs teams. |
| Administrator | User, data, AI, system and subscription configuration | Administers the organization. |
| FinOps | Statistics and finance management + Invoice access | Tracks usage, costs and billing. |
:::warning The administrator no longer does everything The Administrator group holds no business rights: no pipeline, no knowledge base, no agent. This separation of duties is deliberate. An administrator who also needs to build pipelines adds the "Pipeline creation" profile to their own group — they are entitled to. :::
The ten profiles shipped
| Profile | What it opens |
|---|---|
| Document checking | User interface; read and run pipelines |
| Pipeline creation | User and Manager interfaces; pipelines, agents, knowledge bases and their documents, indexing, RAG profiles, skills, correspondences, benchmarks, AI models, interceptors, API keys |
| Statistics and finance management | Manager interface; statistics, costs, ROI and pricing |
| Team management | Manager interface; team creation and member assignment |
| User configuration | Admin interface; accounts, profiles and groups |
| Data configuration | Admin interface; storage spaces, vectors, external databases, retention |
| AI configuration | Admin interface; model providers, MCP connectors, skills policy |
| System configuration | Admin interface; settings, SSO, firewall, email, scheduled tasks |
| Subscription configuration | Admin interface; subscribed plan |
| Invoice access | Invoices tab |
Management
From Admin → Users → Groups and Admin → Users → Profiles (Profiles and groups — write permission):
- Create a profile: a name, a description, and the permission matrix to tick (one row per resource, one column per action). The "All / none" button at the end of each row ticks or unticks the whole resource.
- Create a group: a name and the profiles it bundles. The dialog shows live what the current selection will actually grant.
- Edit a profile or a group: the effect applies immediately to every affected account, on their next request.
- Delete: a profile still used by a group is refused; so is a group still assigned to a user. The reference must be cleared first.
Two safeguards
- Nobody grants more than they hold. Someone holding only the "User configuration" profile cannot assign a group carrying system or data rights: without this rule, they would grant themselves in one click what they don't have.
- Nobody edits an account more privileged than their own. Without this rule, resetting the administrator's password would be enough to take their place. This check covers administration rights, not business rights: an administrator can therefore manage a manager's account perfectly well.
An account with no group
A user with no group holds no permission: they can sign in, but no screen opens. This is deliberate — an unattached account is one somebody forgot to configure, not a free one. The Admin → Users screen flags it explicitly.