Roles and Rights

Everything someone may do in your Tenant comes from Rights. A Right allows one thing, such as managing users. Rights are only ever added: a user may do what any of their Roles allows.

A Role bundles Rights. Every Tenant starts with two Roles, called presets:

• Admin holds every Right from managing users to off-boarding the Tenant, and the Right to give code internet access, but neither of the Rights on all Data Sources.
• Member holds the Right to register Personal Integrations and the Right to give code internet access.

You may change the Rights of both presets, but you can’t rename or delete them. Your Tenant can also have Roles of its own.

You need the Right to manage Roles and Rights for everything on this page. Admins hold it.

The Rights

Right	What it allows
Manage users	Invite users, change their Roles, deactivate and remove them.
Manage Groups	Create, rename and delete Groups and choose their members.
Manage Roles and Rights	Create, change and delete Roles, as described here.
Manage sign-in	Choose how people sign in to your Tenant: SSO, verified domains, the sign-in methods allowed and whether MFA is required.
Create Data Sources and Managed Databases	Connect new Data Sources and create Managed Databases.
Manage Integrations	Turn on Integrations from the Integration Catalog and register or deactivate Tenant Integrations.
Register Personal Integrations	Register Integrations that only the user themselves can use.
Manage Skill access	Choose who may use which Tenant Skill.
Read rated Turns	Read the Turns users rated with Feedback. See Rated Turns.
Read the Audit Log	Read who did what in your Tenant.
Manage orphaned Context Entries	See and link or delete Context Entries whose last Data Source was deleted.
Read and manage all Shared Drives	Read and manage every Shared Drive of your Tenant.
Off-board the Tenant	Off-board your Tenant, which locks it.
Access to all Data Sources	Use every Data Source of your Tenant, including future ones.
Accept on all Data Sources	Accept Context Change Requests on every Data Source of your Tenant, including future ones.
Sandbox has internet access	Code the agent runs for the user can reach the internet. See Internet access for code.

Some of these Rights guard features that are still to come. You can already put them into Roles, and they take effect as the features arrive.

Internet access for code

The agent runs code in a Sandbox, for example to calculate. With the Right Sandbox has internet access, the code can reach the internet: it can download a public dataset or install a package. Without it, the code reaches nothing but the user’s own Personal Drive.

Both presets hold the Right. A new Tenant starts with it on Admin and Member, and Tenants that existed before got it once on their presets. If you don’t want it, remove the Right from both Roles: select the pencil next to each, clear Sandbox has internet access and select Save. A Right you removed is never added again.

Know the risk before you grant it. Code with internet access can send data and credentials out of the platform, for example after a prompt injection hidden in a file a user uploads. The platform hides credentials in what users and the model see, but that doesn’t stop code that is written to get at them. The Admin App warns you wherever the Right is shown or granted: in the Role editor, on the Roles, Groups and Users pages, and in the dialogs that give Roles to users and Groups. We record the traffic of the Sandbox so that it can be traced afterwards. The Trust Center describes the risk and what we log.

A change takes effect at once for the user’s next run of code: it starts in a new Sandbox, so the variables and files of earlier runs are gone.

Removing the Right stops running Sandboxes. When you take the Right away from a user, whether by removing it from a Role, changing the user’s Roles or a Group’s Roles or members, deleting a Role or a Group, deactivating or removing the user, or off-boarding the Tenant, we stop the user’s running Sandbox sessions within moments. Code that was running at that moment ends, and its internet access and credentials end with it. The same happens when a user deletes a Conversation: its Sandbox session is stopped.

See the Roles

In the Admin App, open Roles. You see the presets first, then your Tenant’s own Roles, each with its Rights and the Groups it is given to. Members of those Groups hold the Role’s Rights too.

Create a Role

1. Select New Role.
2. Enter a name. No two Roles may have the same name.
3. Select the Rights the Role holds.
4. Select Save.

Change a Role

Select the pencil next to a Role. Change its name or its Rights, then select Save. A preset keeps its name.

A change takes effect at once. Users with the Role don’t need to sign in again.

Delete a Role

Select the bin next to one of your Tenant’s own Roles, then Delete. Users with the Role lose its Rights at once. The presets can’t be deleted.

Your Tenant always keeps someone who can manage Roles

The Admin App refuses a change that would leave no active user with the Right to manage Roles and Rights, for example taking that Right from the Admin Role while nobody else holds it. Give the Right to another active user first.

Every change to a Role is recorded in your Tenant’s Audit Log, with who made it and which Rights were given or taken.