Groups and access
Access sets which tools and models each employee’s AI client can reach. Groups sync from your identity provider through SCIM. Configure access in Provisioning.
Granting access does not connect anything. Each employee still authenticates every Connector over OAuth.
Access is separate from dashboard role, which sets what someone can do in the Workforce dashboard. See Team and roles.
How tool access combines
Tool access is the union of the organization default, every Group the employee is in, per-employee grants, and approved access requests. The most permissive wins. Dashboard role is the highest assigned.
A Group set to No tools contributes nothing; it doesn’t remove access granted elsewhere.
How model access combines
- Routing policy: the Group’s own policy, or the organization default
- Approved models: union. One unrestricted Group makes the employee unrestricted
- Budgets: nest. The first limit exhausted blocks the request
Set the organization default
- Open Provisioning → Sync → Default access → Configure.
- Pick a dashboard role.
- Pick a tool access mode. Under Choose tools, attach Tool Packs and tools.
- Optionally add Shared accounts: a connector account every employee can use without connecting their own.
Keep the default narrow and grant up through Groups.
Configure a Group
Open a Group from the Groups tab.
Grant Tool Packs to Groups as your main mechanism. Use per-employee grants only for exceptions.
Grant access to one employee
Open an employee from the Employees tab and go to Access. It shows their effective Connectors, skills, and the source of each grant.
Add connector grants every tool on one Connector. It shows Not connected until the employee authenticates. It is unavailable for employees set to all tools or no tools; adjust their Group or the default instead.
Access requests
A call to a tool the employee lacks fails and creates an access request. Approve, deny, or expire it in Requests.
Next: SCIM provisioning.