How access works in IntraLLM, end to end. Operational guides: Users & Groups, Permissions.
The access model
feature enabled (Admin Panel section)
AND resource available (model/connection configured)
AND permitted for the user's groups
= the user sees the feature
Diagnosing "user can't see feature X": check those three gates in that order.
Platform roles
| Role | Scope |
|---|---|
| Admin | Full platform control including the Admin Panel. Assign to few; assume breach if compromised. |
| Power User | Standard capabilities plus creator features as permitted. Typical for champions and technical staff. |
| User | Day-to-day use — chat, documents, media — within group permissions. The default for most people. |
| Pending | Account exists but isn't active yet (approval workflows). No product access until approved. |
Roles set the ceiling; permissions set the doors beneath it.
Permission areas
| Area | Examples of what it gates |
|---|---|
| Workspace | Create/manage models, knowledge bases, prompts, tools. |
| Chat | Chat controls, file upload, delete chats, edit messages, temporary chats. |
| Features | Web search, image generation, video generation, code interpreter, vision, direct tool servers, agentic, training, workflows. |
Each permission is granted per group; a user's effective access is the union across their groups.
Model visibility (a separate axis)
Model access is curated, not permissioned per person:
| Mechanism | Effect |
|---|---|
| Models (Admin) → Default Models | Models every user sees. |
| Show/Hide | Global selector visibility. |
| Group access | Advanced per-model access where used. |
| Personal connections | A user's own endpoints, visible only to them. |
Worked examples
"Read-only analysts": User role; group with chat + file upload + knowledge access to their bases; no creator features; no personal API keys.
"Automation team": Power User; tools, workflows, code interpreter, agentic enabled; knowledge write access; monitored via usage.
"Contractors": User role; chat only; no file upload; no personal keys; session expiry tightened; deactivation process documented.
"ML platform engineers": Admin or Power User; training permission; model management; GPU dashboard access.
Anti-patterns
- Everyone an admin "for now" — then nobody knows who changed what.
- Permissions edited per individual instead of per group — un-auditable.
- Disabling the platform because one feature worries you — restrict that feature's group instead.
- No leaver process — accounts outlive employment. Automate deactivation with HR offboarding.