Capabilities and access¶
In Actian AI Analyst, what a member can do is set by Capabilities: a set of on/off permissions held at two levels. Some Capabilities apply to the whole organization. Others apply to one Workspace at a time. There are no roles. Administrator, Editor, Viewer and Billing contact are presets that switch on a set of Capabilities in one click.
Availability
- Who can do this: members with the Manage members and access capability (for the organization) can set anyone's Capabilities. Members with Manage members in a Workspace can set Capabilities for that Workspace only, from Settings → Administration → Workspaces. They can't open the Members page.
- Deployment: Actian SaaS and self-managed deployments.
You set Capabilities on the Members page (Settings → Administration → Members, then Edit access…). You can also set Workspace capabilities from Settings → Administration → Workspaces (Members). See Workspaces.
Organization capabilities¶
Organization capabilities apply across the whole organization. They don't depend on which Workspace is active.
| Capability | What it lets a member do | Product access it gives |
|---|---|---|
| Manage organization | Manage organization settings, security, audit logs, API keys and Workspaces. When Restrict connection management is on, only members with this capability (and Edit in the Workspace) can add, edit or delete organization connections. | Studio and Explorer |
| Manage members and access | Invite and remove members, and set Capabilities for any member, at organization level and in Workspaces. | Studio and Explorer |
| Manage billing | Manage the organization's billing and subscription. | Explorer only |
| Manage inference | Choose the organization's LLM and Embedding endpoints: its own OpenAI-compatible APIs or the deployment's default. | Explorer only |
Manage inference and your plan
Changing the organization's inference endpoints also needs a plan that includes customer-hosted inference. Without it, Settings → Administration → Inference shows "Your plan doesn't include customer-hosted inference, so your organization uses the deployment's default. Contact Actian to add it." Members with Studio access who don't hold Manage inference can open the Inference page but can't change it. They see "Only members with Manage inference can change your organization's inference."
A member with Manage organization can turn on Restrict connection management under Settings → Administration → Security. With it on, only members with Manage organization (who also need Edit in the Workspace) can add, edit or delete organization connections. Members with Edit keep read access.
No organization capability lets a member author content in a Workspace. To build Analysts or edit the semantic layer, a member also needs Edit in that Workspace.
Workspace capabilities¶
Workspace capabilities are held separately in each Workspace. A member can have Edit in one Workspace and only Chat in another.
| Capability | What it lets a member do in that Workspace | Product access it gives |
|---|---|---|
| Chat | Converse with the Workspace's Analysts. Use and share conversations and Artifacts, create and manage Scheduled Insights, use the Explorer Inbox, use saved prompts and leave feedback. | Explorer |
| Edit | Everything in Chat, plus authoring Analysts, the semantic layer, connections and Steward configuration (including the Steward inbox). Also covers integrations, monitoring and rolling back Model versions. | Studio and Explorer |
| Manage members | Everything in Chat, plus adding and removing members of this Workspace and setting their Workspace capabilities. | Studio and Explorer |
Chat comes with Edit and Manage members. When you switch either of them on, Chat switches on too and you can't switch it off.
A member with Manage members in a Workspace can only grant the Capabilities they hold in that Workspace. For example, someone with Manage members but not Edit can't give anyone Edit. They can manage members only in their active Workspace. Members with the organization capability Manage members and access don't have this limit.
How Capabilities combine¶
In the Workspace you are working in, you can do everything allowed by:
- your organization capabilities, plus
- the Capabilities you hold in that Workspace.
Capabilities only add permissions; none takes one away.
Changes take effect on the member's next action. They don't need to sign out and back in.
No automatic access to every Workspace¶
No Capability gives automatic access to every Workspace. Every member, Administrators included, can open and work in only the Workspaces where they hold Chat, Edit or Manage members. Members with Manage organization see every Workspace in Settings → Administration → Workspaces, but can't work in one until they hold a Workspace capability there.
A member with Manage members and access can give themselves access to a Workspace, either from Settings → Administration → Workspaces (Members) or from Settings → Administration → Members (Edit access…).
Note
The access editors list every Workspace in the organization only if you also hold Manage organization. With Manage members and access alone, you see only the Workspaces you already belong to.
Which part of the product a member sees¶
| What the member holds | What they can open |
|---|---|
| Edit or Manage members in the active Workspace, or Manage organization, or Manage members and access | Studio and Explorer |
| Chat only | Explorer |
| Manage billing only | The Explorer settings area, opening on Billing |
| Manage inference only | The Explorer settings area |
| Nothing (No access) | Nothing. When they sign in they see No product access yet. |
Presets¶
A preset fills in a fixed set of Capabilities in one click. You can't create your own presets.
| Preset | Organization capabilities | Workspace capabilities |
|---|---|---|
| Administrator | Manage organization, Manage members and access, Manage billing, Manage inference | Manage members and Edit (and so Chat) |
| Editor | None | Edit (and so Chat) |
| Viewer | None | Chat |
| Billing contact | Manage billing | None |
A preset's Workspace capabilities go to a single Workspace:
- When you pick a preset on the Members page (when inviting someone, or in Edit access…), they go to the Workspace you are currently working in.
- When AI Analyst applies a preset automatically (the organization's Default preset), they go to the organization's default Workspace.
To give someone access to more Workspaces, switch on their Capabilities in each Workspace.
Choosing a preset replaces all of the member's current Capabilities, including organization-level permissions and access in other Workspaces, with the preset's set for the current Workspace. To keep access in other Workspaces, switch individual Capabilities instead of choosing a preset.
The person who creates an organization is given the Administrator preset.
A preset is applied once. AI Analyst doesn't remember which preset you picked, so you can change individual Capabilities afterwards. The Access column on the Members page shows:
- the preset name, when a member's Capabilities exactly match a preset,
- Custom, when they don't (for example, Capabilities in more than one Workspace),
- No access, when the member holds no Capabilities.
No access¶
No access means a member holds no Capability at any level. When you set a member to No access:
- they stay a member of the organization and keep their login,
- they can't open Studio or Explorer,
- their Seat is released,
- they are signed out of their active sessions.
To give them access again, open Edit access… and switch on the Capabilities they need.
No access is different from removing a member. See Members.
How new members get their Capabilities¶
The first time someone signs in to your organization, AI Analyst gives them Capabilities in this order:
- Capabilities chosen for them in advance. These are the Capabilities set when they were invited, added ahead of their first SSO sign-in, or edited on the Members page before they signed in.
- The organization's Default preset, if nothing was chosen for them in advance and they don't hold anything yet.
This happens once per person. If you later set someone to No access, the Default preset isn't applied to them again.
Default preset¶
The Default preset is set by Capabilities to give new users. It is applied when someone joins without Capabilities chosen in advance, for example:
- people who join automatically on their first Enterprise SSO sign-in,
- on self-managed deployments, people who join through Sign-up domains.
It defaults to Viewer. Changing it doesn't change existing members.
Availability
- Who can do this: members with the Manage organization capability (for the organization).
- Plan: Included only in plans that enable Enterprise SSO.
- Deployment: Actian SaaS and self-managed deployments.
To change the Default preset:
- Go to Settings → Administration → Security.
- Set up an Enterprise SSO connection if you don't have one. The setting appears only after a connection exists.
- Under Provisioning, turn on Automatically add members on first sign in.
- Choose a preset in Capabilities to give new users.
Capabilities to give new users can be changed only while Automatically add members on first sign in is on. Turning it on means anyone who signs in through your Enterprise SSO becomes a member and takes a Seat, even past your Seat limit.
Without an Enterprise SSO connection you can't change the Default preset in the app. A new organization starts with Viewer.
Safeguards¶
- At least one member must hold Manage members and access. You can't remove the last member who holds it, and they can't leave the organization. You see "An organization needs at least one Admin. Make someone else an Admin before changing or removing this member." On Settings → Administration → Organization, the last holder sees "You're the last Admin, so you can't leave this organization." People still waiting for their first SSO sign-in don't count.
- You can't lock yourself out. You can't switch off your own Manage members and access or set yourself to No access. If you try, AI Analyst first asks Change your own access? and then refuses the change ("You cannot set your own Access role to No access."). Ask another member with Manage members and access to make the change.
Note
Some messages in the app still say "Admin" or "Access role". In these messages, "Admin" means a member who holds Manage members and access.
Audit log¶
When you change a member's organization capabilities with Edit access…, the change is recorded in the audit log with the values before and after. Workspace capability changes are recorded when you make them from Settings → Administration → Workspaces (Members), not in Edit access…. Capabilities applied when someone first signs in, and removing a member, aren't recorded as capability changes.
If you're used to roles¶
Earlier versions of these docs described roles. Each role has a closest preset:
| Earlier role | Closest preset | What's different |
|---|---|---|
| Admin | Administrator | Gives Workspace access in one Workspace only, not in every Workspace. |
| Studio | Editor | Applies to one Workspace. Grant Edit in each Workspace the person needs. |
| Explorer | Viewer | Applies to one Workspace. Grant Chat in each Workspace the person needs. |
| Billing | Billing contact | Manages billing and the subscription only. Lands in the Explorer settings area. |
| Workspace Manager | Manage members in that Workspace | Can grant only the Capabilities they hold in that Workspace. |