Groups and roles
Groups and roles decide who sees and does what in your organization. Every person has one role; people with the Custom role get what the custom roles of their groups allow. Changes reach chats in a couple of minutes.
The five roles
Section titled “The five roles”These options are rolling out and may not be available in your organization yet.
Each person has exactly one:
| Role | What they can do |
|---|---|
| Primary Owner | Everything, within your organization’s limits. There is exactly one: the designated owner of the account. Only they transfer ownership. |
| Owner | Everything, including members, roles, billing, connectors, plugins and skills. Can’t transfer ownership. |
| Admin | Manages members and seats: invites, removes and reassigns seat tiers, and sees Analytics without spend. Doesn’t see Billing, Usage, Groups or Roles, and doesn’t change roles. |
| User | Uses what the organization enables for them. No administration. |
| Custom | Gets what the custom roles of their groups give them. With no groups, or groups with no role, nothing. |
The role is changed in Organization → Members (see Managing members). Nobody changes their own role, and the Primary Owner changes only by transfer to a member who has already signed in, typing their email to confirm; the previous one stays an Owner.
Who sees what
Section titled “Who sees what”Each part of Organization belongs to an area. Owners and the Primary Owner have all of them; an Admin has User Management and Analytics; a Custom person has the areas of their roles.
| Page | Who sees it |
|---|---|
| Notifications | Whoever can resolve some kind of request: Libraries (connectors and skills), Billing (credit), User Management (join) |
| Organization and access | Identity & Access |
| Billing and Usage | Billing |
| Analytics | Analytics; spend, the credits column and export need Billing |
| Data and privacy | Privacy |
| Members | User Management (Admins have it) |
| Groups and Roles | Identity & Access |
| Skills and Connectors | Libraries |
| Capabilities, Models, Git providers, Appearance, Formats | Owners and the Primary Owner |
Organization settings appears in the account menu if you see at least one page. With Can view a page is the same page with its controls disabled and “You have view-only access.” under the title; changing anything needs Can manage.
Groups
Section titled “Groups”Groups are collections of members that can share roles. The table has Name, Members (how many), Roles (the labels), Source and Visibility.
To build one:
- Click Add group and type the Group name. Adding a group only asks for the name.
- With Edit you add people under Members (the dropdown says Add member…), change the name and set the Visibility.
Under Source each group says where its members come from: Manual ones you manage yourself in Nouter, and Directory ones are groups whose members come from your directory and are managed there, so their name and members aren’t edited in Nouter.
Delete takes a group off every role. The confirmation says so: “Deleting the group takes it off every role. Its members keep their accounts.”
Visibility
Section titled “Visibility”These options are rolling out and may not be available in your organization yet.
Each group has three settings, in Visibility settings: Discover this group, Share resources with this group and See group members. Each one is given to Group members, to Everyone in the organization or to nobody; with both boxes empty it’s off, and everything is off in a new group. Today the settings are saved and shown in the Visibility column of the table. Nothing in Nouter uses them yet: sharing with groups and finding groups arrive in a later release, and the settings will apply then. Owners, the Primary Owner and custom roles with Identity & Access always see every group. The settings are the same for Manual and Directory groups.
Custom roles
Section titled “Custom roles”A custom role is a named set of what a person can do. The table has Name, Groups (the labels of the groups that have it), Admin access and Created. To build one, click Add role, type the Role name and a Description, and with Edit pick the Groups (the dropdown says Add group…) that receive it.
A role is always assigned to groups, never to a person. A person in several groups gets the union of their roles, and one role can’t take away what another grants. Roles apply only to people with the Custom role. Delete takes a role off the models it was available to (the confirmation says so: “Deleting the role takes it off the models it was available to. Its groups stay.”).
When there are roles but nobody is Custom, a yellow notice appears above Roles: “Map groups to roles and then set members’ role type to Custom.”, with Go to Members.
Which models a role can use is set in Organization → Models, in the Available to column (see below).
Capabilities and permissions
Section titled “Capabilities and permissions”These options are rolling out and may not be available in your organization yet.
Each role has two tabs:
- Capabilities: which features they can use. At the top you choose All capabilities, All generally available or Only selected; the first two include the new capabilities as they arrive. Today the tab covers Web fetch, Web search, sharing workspaces with people, sharing workspaces that use connectors, and publishing blueprints. A role that doesn’t grant one blocks it for that person, and the message says: “Contact your admin to request access to this feature.”
- Permissions: which areas of the organization they administer: Identity & Access, Billing, Analytics, Privacy, User Management and Libraries. Each is set to No access, Can view or Can manage; Analytics only has Can view and User Management only Can manage.
A new role starts with All generally available capabilities and no administration areas. The roles that already existed start with All capabilities, so nobody loses anything.
Identity & Access in Can manage lets someone edit groups and roles, including their own role: give it only to administrators you trust.
Which models each person uses
Section titled “Which models each person uses”Each role’s models are chosen in Organization → Models, in the Available to column (see Which models your organization uses):
- Whoever isn’t Custom sees every enabled model.
- A Custom member sees the enabled models that are set to All roles plus the ones that share one of their roles.
- A Custom member with no roles sees only the models set to All roles.
If a chat asks for a model that isn’t allowed for that person, it runs on the default model if that one is allowed, and otherwise on the first allowed one. If none is left, the chat says so: “Your organization hasn’t given you access to any model.”