Roles and Rights

Everything someone may do in your Tenant comes from Rights. A Right allows one thing, such as managing users. Rights are only ever added: a user may do what any of their Roles allows.

A Role bundles Rights. Every Tenant starts with two Roles, called presets:

• Admin holds every Right from managing users to off-boarding the Tenant, but neither of the Rights on all Data Sources.
• Member holds the Right to register Personal Integrations.

You may change the Rights of both presets, but you can’t rename or delete them. Your Tenant can also have Roles of its own.

You need the Right to manage Roles and Rights for everything on this page. Admins hold it.

The Rights

Right	What it allows
Manage users	Invite users, change their Roles, deactivate and remove them.
Manage Groups	Create, rename and delete Groups and choose their members.
Manage Roles and Rights	Create, change and delete Roles, as described here.
Manage sign-in	Choose how people sign in to your Tenant: SSO, verified domains, the sign-in methods allowed and whether MFA is required.
Create Data Sources and Managed Databases	Connect new Data Sources and create Managed Databases.
Manage Integrations	Turn on Integrations from the Integration Catalog and register or deactivate Tenant Integrations.
Register Personal Integrations	Register Integrations that only the user themselves can use.
Manage Skill access	Choose who may use which Tenant Skill.
Read rated Turns	Read the Turns users rated with Feedback.
Read the Audit Log	Read who did what in your Tenant.
Manage orphaned Context Entries	See and link or delete Context Entries whose last Data Source was deleted.
Read and manage all Shared Drives	Read and manage every Shared Drive of your Tenant.
Off-board the Tenant	Off-board your Tenant, which locks it.
Access to all Data Sources	Use every Data Source of your Tenant, including future ones.
Accept on all Data Sources	Accept Context Change Requests on every Data Source of your Tenant, including future ones.

Some of these Rights guard features that are still to come. You can already put them into Roles, and they take effect as the features arrive.

See the Roles

In the Admin App, open Roles. You see the presets first, then your Tenant’s own Roles, each with its Rights and the Groups it is given to. Members of those Groups hold the Role’s Rights too.

Create a Role

1. Select New Role.
2. Enter a name. No two Roles may have the same name.
3. Select the Rights the Role holds.
4. Select Save.

Change a Role

Select the pencil next to a Role. Change its name or its Rights, then select Save. A preset keeps its name.

A change takes effect at once. Users with the Role don’t need to sign in again.

Delete a Role

Select the bin next to one of your Tenant’s own Roles, then Delete. Users with the Role lose its Rights at once. The presets can’t be deleted.

Your Tenant always keeps someone who can manage Roles

The Admin App refuses a change that would leave no active user with the Right to manage Roles and Rights, for example taking that Right from the Admin Role while nobody else holds it. Give the Right to another active user first.

Every change to a Role is recorded in your Tenant’s Audit Log, with who made it and which Rights were given or taken.