Users and Teams
User accounts
A HocNota account belongs to a single organization. It has a username, an email, a password (or an Azure AD SSO link — see Azure AD Connectivity), an interface language (FR/EN) and a notification preference for job-completion emails.
Light/dark theme is a browser preference (stored locally), not account data: it does not follow the user from one device to another.
Roles
HocNota uses a granular role system rather than a simple user/manager/admin split. Each role grants access to a specific family of features:
| Role | Grants access to |
|---|---|
check_document | Base role: submit documents for analysis, view your own results |
user_manager | User account management |
pipeline_manager | Pipeline management, unrestricted access to all active pipelines (not just those of your team) |
team_manager | Team management and membership |
module_manager | Management of AI agents, interceptors and attached MCP connectors |
kb_manager | Knowledge base management (including deletion) |
finops | Viewing and configuring AI costs (Finance tab) |
api_key_manager | Generating and managing API keys |
admin_system | Full system administration (organization, storage, integrations, AI models, RAG, MCP, vectors…) |
Three legacy roles (user, manager, admin) are still accepted for compatibility: they grant equivalent access to all the granular roles above (full "old-style" access).
An account can be assigned a role directly, or point to a user profile that combines several reusable granular roles — see User Profiles. If a profile is assigned, its roles take precedence over the account's direct role.
Access to the Manager interface (Agents, Pipelines, Teams, Knowledge Bases, Finance, Statistics tabs…) is open to anyone holding at least one of the management roles above (or a legacy role) — each tab is then further filtered by whichever precise role grants it.
Teams
A team groups users under a team manager and is assigned a subset of the organization's active pipelines.
Concrete effect on who can run which pipeline:
- A user with only the base role (
check_document) can only run an analysis with an active pipeline assigned to their team. Any attempt on another pipeline fails (the API responds "not found" rather than revealing the existence of an unauthorized pipeline). - A
pipeline_manager(or a legacymanager/adminrole) is not subject to this restriction: they can run any active pipeline. - If no pipeline is specified when starting an analysis, the organization's single default active pipeline is used for everyone.
Team management (creation, members, assigned pipelines) is done from Manager → Settings → Teams.