Permissions control what each group can do. Together with capability enablement, they decide what features actually appear for each user — the enforcement point for least privilege.
How permissions work
- Permissions are set per group. A user's access is the sum of their group assignments.
- A feature must be enabled in its Admin Panel section and permitted for the group before users see it.
- Changes apply to users on their next action; tell groups when access changes.
Permission areas
Workspace — creator features
| Permission | Grants the ability to… |
|---|---|
| Models access | Create and manage custom models. |
| Knowledge access | Create and manage knowledge bases. |
| Prompts access | Create and share prompts in the library. |
| Tools access | Access and manage tools — powerful, because tools can act on your systems; grant deliberately. |
Chat — conversation behaviour
| Permission | Grants the ability to… |
|---|---|
| Chat Controls | Adjust per-conversation settings (capabilities, model parameters). |
| File Upload | Attach files to conversations. |
| Chat Delete | Delete conversations. |
| Chat Edit | Edit/branch messages. |
| Temporary Chat | Start conversations that aren't saved to history. |
Features — capabilities
| Permission | Grants the ability to… |
|---|---|
| Web Search | Search the internet from chat. |
| Image Generation | Generate images. |
| Video Generation | Generate video. |
| Code Interpreter | Run code from chat. |
| Vision | Analyse images. |
| Direct Tool Servers | Connect personally to tool servers. |
| Agentic | Use agentic workflows and deep agents. |
| Training | Run fine-tuning jobs. |
| Pipelines/Workflows | Build and run workflows. |
Note:
The exact list mirrors what your deployment licenses and enables — a feature switched off globally does not appear here.
Sensible defaults by group
| Group | Reasonable starting permissions |
|---|---|
| All staff | Chat with file upload; delete/edit own chats; no creator features until needed. |
| Power users / champions | + knowledge, prompts, models access; image generation. |
| Automation team | + tools, workflows, code interpreter, agentic. |
| ML/platform | + training, video generation. |
| Contractors / guests | Chat only; no upload; no personal API keys. |
Review discipline
- Quarterly — review group memberships and permission drift.
- On departure — deactivate accounts; remove group seats.
- After incidents — re-check the relevant permission with fresh eyes.
- Keep a change record of who changed what permission, when (your audit process).