---
description: How Capabilities control what each member can do in Actian AI Analyst, at organization level and in each Workspace, and how the Administrator, Editor, Viewer and Billing contact presets work.
---

# Capabilities and access

In Actian AI Analyst, what a member can do is set by **Capabilities**: a set of on/off permissions held at two levels. Some Capabilities apply to the whole organization. Others apply to one Workspace at a time. There are no roles. **Administrator**, **Editor**, **Viewer** and **Billing contact** are presets that switch on a set of Capabilities in one click.

!!! info "Availability"
    - **Who can do this:** members with the **Manage members and access** capability (for the organization) can set anyone's Capabilities. Members with **Manage members** in a Workspace can set Capabilities for that Workspace only, from **Settings** → **Administration** → **Workspaces**. They can't open the Members page.
    - **Deployment:** Actian SaaS and self-managed deployments.

You set Capabilities on the [Members](members.md) page (**Settings** → **Administration** → **Members**, then **Edit access…**). You can also set Workspace capabilities from **Settings** → **Administration** → **Workspaces** (**Members**). See [Workspaces](workspaces.md).

## Organization capabilities

Organization capabilities apply across the whole organization. They don't depend on which Workspace is active.

| Capability | What it lets a member do | Product access it gives |
| --- | --- | --- |
| **Manage organization** | Manage organization settings, security, audit logs, API keys and Workspaces. When **Restrict connection management** is on, only members with this capability (and **Edit** in the Workspace) can add, edit or delete organization connections. | Studio and Explorer |
| **Manage members and access** | Invite and remove members, and set Capabilities for any member, at organization level and in Workspaces. | Studio and Explorer |
| **Manage billing** | Manage the organization's billing and subscription. | Explorer only |
| **Manage inference** | Choose the organization's LLM and Embedding endpoints: its own OpenAI-compatible APIs or the deployment's default. | Explorer only |

!!! note "Manage inference and your plan"
    Changing the organization's inference endpoints also needs a plan that includes customer-hosted inference. Without it, **Settings** → **Administration** → **Inference** shows "Your plan doesn't include customer-hosted inference, so your organization uses the deployment's default. Contact Actian to add it." Members with Studio access who don't hold **Manage inference** can open the Inference page but can't change it. They see "Only members with Manage inference can change your organization's inference."

A member with **Manage organization** can turn on **Restrict connection management** under **Settings** → **Administration** → **Security**. With it on, only members with **Manage organization** (who also need **Edit** in the Workspace) can add, edit or delete organization connections. Members with **Edit** keep read access.

No organization capability lets a member author content in a Workspace. To build Analysts or edit the semantic layer, a member also needs **Edit** in that Workspace.

## Workspace capabilities

Workspace capabilities are held separately in each Workspace. A member can have **Edit** in one Workspace and only **Chat** in another.

| Capability | What it lets a member do in that Workspace | Product access it gives |
| --- | --- | --- |
| **Chat** | Converse with the Workspace's Analysts. Use and share conversations and Artifacts, create and manage Scheduled Insights, use the Explorer Inbox, use saved prompts and leave feedback. | Explorer |
| **Edit** | Everything in **Chat**, plus authoring Analysts, the semantic layer, connections and Steward configuration (including the Steward inbox). Also covers integrations, monitoring and rolling back Model versions. | Studio and Explorer |
| **Manage members** | Everything in **Chat**, plus adding and removing members of this Workspace and setting their Workspace capabilities. | Studio and Explorer |

**Chat** comes with **Edit** and **Manage members**. When you switch either of them on, **Chat** switches on too and you can't switch it off.

A member with **Manage members** in a Workspace can only grant the Capabilities they hold in that Workspace. For example, someone with **Manage members** but not **Edit** can't give anyone **Edit**. They can manage members only in their active Workspace. Members with the organization capability **Manage members and access** don't have this limit.

## How Capabilities combine

In the Workspace you are working in, you can do everything allowed by:

- your organization capabilities, plus
- the Capabilities you hold in that Workspace.

Capabilities only add permissions; none takes one away.

Changes take effect on the member's next action. They don't need to sign out and back in.

### No automatic access to every Workspace

No Capability gives automatic access to every Workspace. Every member, Administrators included, can open and work in only the Workspaces where they hold **Chat**, **Edit** or **Manage members**. Members with **Manage organization** see every Workspace in **Settings** → **Administration** → **Workspaces**, but can't work in one until they hold a Workspace capability there.

A member with **Manage members and access** can give themselves access to a Workspace, either from **Settings** → **Administration** → **Workspaces** (**Members**) or from **Settings** → **Administration** → **Members** (**Edit access…**).

!!! note
    The access editors list every Workspace in the organization only if you also hold **Manage organization**. With **Manage members and access** alone, you see only the Workspaces you already belong to.

## Which part of the product a member sees

| What the member holds | What they can open |
| --- | --- |
| **Edit** or **Manage members** in the active Workspace, or **Manage organization**, or **Manage members and access** | Studio and Explorer |
| **Chat** only | Explorer |
| **Manage billing** only | The Explorer settings area, opening on **Billing** |
| **Manage inference** only | The Explorer settings area |
| Nothing (**No access**) | Nothing. When they sign in they see **No product access yet**. |

## Presets

A preset fills in a fixed set of Capabilities in one click. You can't create your own presets.

| Preset | Organization capabilities | Workspace capabilities |
| --- | --- | --- |
| **Administrator** | **Manage organization**, **Manage members and access**, **Manage billing**, **Manage inference** | **Manage members** and **Edit** (and so **Chat**) |
| **Editor** | None | **Edit** (and so **Chat**) |
| **Viewer** | None | **Chat** |
| **Billing contact** | **Manage billing** | None |

A preset's Workspace capabilities go to a single Workspace:

- When you pick a preset on the Members page (when inviting someone, or in **Edit access…**), they go to **the Workspace you are currently working in**.
- When AI Analyst applies a preset automatically (the organization's Default preset), they go to **the organization's default Workspace**.

To give someone access to more Workspaces, switch on their Capabilities in each Workspace.

Choosing a preset replaces all of the member's current Capabilities, including organization-level permissions and access in other Workspaces, with the preset's set for the current Workspace. To keep access in other Workspaces, switch individual Capabilities instead of choosing a preset.

The person who creates an organization is given the **Administrator** preset.

<!-- screenshot: workspaces-access-capability-editor-expanded -->

A preset is applied once. AI Analyst doesn't remember which preset you picked, so you can change individual Capabilities afterwards. The **Access** column on the Members page shows:

- the preset name, when a member's Capabilities exactly match a preset,
- **Custom**, when they don't (for example, Capabilities in more than one Workspace),
- **No access**, when the member holds no Capabilities.

## No access

**No access** means a member holds no Capability at any level. When you set a member to **No access**:

- they stay a member of the organization and keep their login,
- they can't open Studio or Explorer,
- their Seat is released,
- they are signed out of their active sessions.

To give them access again, open **Edit access…** and switch on the Capabilities they need.

**No access** is different from removing a member. See [Members](members.md#set-no-access-or-remove-a-member).

## How new members get their Capabilities

The first time someone signs in to your organization, AI Analyst gives them Capabilities in this order:

1. **Capabilities chosen for them in advance.** These are the Capabilities set when they were invited, added ahead of their first SSO sign-in, or edited on the Members page before they signed in.
2. **The organization's Default preset**, if nothing was chosen for them in advance and they don't hold anything yet.

This happens once per person. If you later set someone to **No access**, the Default preset isn't applied to them again.

### Default preset

The Default preset is set by **Capabilities to give new users**. It is applied when someone joins without Capabilities chosen in advance, for example:

- people who join automatically on their first Enterprise SSO sign-in,
- on self-managed deployments, people who join through **Sign-up domains**.

It defaults to **Viewer**. Changing it doesn't change existing members.

!!! info "Availability"
    - **Who can do this:** members with the **Manage organization** capability (for the organization).
    - **Plan:** Included only in plans that enable Enterprise SSO.
    - **Deployment:** Actian SaaS and self-managed deployments.

To change the Default preset:

1. Go to **Settings** → **Administration** → **Security**.
2. Set up an Enterprise SSO connection if you don't have one. The setting appears only after a connection exists.
3. Under **Provisioning**, turn on **Automatically add members on first sign in**.
4. Choose a preset in **Capabilities to give new users**.

**Capabilities to give new users** can be changed only while **Automatically add members on first sign in** is on. Turning it on means anyone who signs in through your Enterprise SSO becomes a member and takes a Seat, even past your Seat limit.

Without an Enterprise SSO connection you can't change the Default preset in the app. A new organization starts with **Viewer**.

## Safeguards

- **At least one member must hold Manage members and access.** You can't remove the last member who holds it, and they can't leave the organization. You see "An organization needs at least one Admin. Make someone else an Admin before changing or removing this member." On **Settings** → **Administration** → **Organization**, the last holder sees "You're the last Admin, so you can't leave this organization." People still waiting for their first SSO sign-in don't count.
- **You can't lock yourself out.** You can't switch off your own **Manage members and access** or set yourself to **No access**. If you try, AI Analyst first asks **Change your own access?** and then refuses the change ("You cannot set your own Access role to No access."). Ask another member with **Manage members and access** to make the change.

!!! note
    Some messages in the app still say "Admin" or "Access role". In these messages, "Admin" means a member who holds **Manage members and access**.

## Audit log

When you change a member's organization capabilities with **Edit access…**, the change is recorded in the [audit log](../governance/audit-logs.md) with the values before and after. Workspace capability changes are recorded when you make them from **Settings** → **Administration** → **Workspaces** (**Members**), not in **Edit access…**. Capabilities applied when someone first signs in, and removing a member, aren't recorded as capability changes.

## If you're used to roles

Earlier versions of these docs described roles. Each role has a closest preset:

| Earlier role | Closest preset | What's different |
| --- | --- | --- |
| Admin | **Administrator** | Gives Workspace access in one Workspace only, not in every Workspace. |
| Studio | **Editor** | Applies to one Workspace. Grant **Edit** in each Workspace the person needs. |
| Explorer | **Viewer** | Applies to one Workspace. Grant **Chat** in each Workspace the person needs. |
| Billing | **Billing contact** | Manages billing and the subscription only. Lands in the Explorer settings area. |
| Workspace Manager | **Manage members** in that Workspace | Can grant only the Capabilities they hold in that Workspace. |