Users and permissions

Manage user accounts, assign roles, organize users into groups, and control access to connectors and agents.

Hadiq.io uses role-based access control (RBAC) to determine what each user can see and do. This page covers how to invite users, change their roles, organize them into groups, and understand how permissions flow through the system.

User roles

Every Hadiq.io user has exactly one role. The role controls which admin features they can access and which content they can view.

Role	Description
Admin	Full access to the Admin panel. Can manage users, configure connectors, set up LLMs, and access analytics.
Basic	Standard user access. Can chat, search, and use agents they have been granted access to.
Curator	Can manage groups they have been designated as curator of, including adding connectors and users to those groups.
Global Curator	Can manage all groups they are a member of, without full admin access.
Limited	Restricted access to a limited set of API endpoints. Used for service accounts and integrations.

Admins cannot demote their own account from the Admin role. Another admin must make that change.

Inviting users

1. Open the Users panel

   Go to Admin > Users.

2. Invite by email

   Click Invite Users, then enter one or more email addresses — one per line or comma-separated.

   If email is configured on your instance, Hadiq.io sends an invitation to each address. Users can sign up and immediately access the workspace.

3. Confirm the invite

   Invited users appear in the Invited tab until they accept and sign up, at which point they move to the Active tab.

You can download the full user list as a CSV from Admin > Users using the Download CSV button. The file includes each user’s email, role, and activation status.

Changing a user’s role

1. Find the user

   Go to Admin > Users and locate the user by email using the search field.

2. Update the role

   Click the role dropdown next to the user and select the new role.

3. Confirm the change

   The role updates immediately. If you are demoting a Curator, Hadiq.io automatically removes their curator relationship from all groups before applying the new role.

Deactivating and deleting users

To prevent a user from signing in without permanently removing their data, deactivate the account first. Deactivated users cannot log in but their chat history and contributions remain intact.

1. Deactivate the user

   Go to Admin > Users, find the user, and click Deactivate.

2. Delete the user (optional)

   Once the account shows as inactive, click Delete User to permanently remove it. This action is irreversible.

You cannot delete an active user. Deactivate the account first.

Groups

Groups let you bundle users together and then grant the group access to connectors and agents. When a connector is restricted to specific groups, only members of those groups can see documents from that connector in search and chat results.

Creating a group

1. Go to Groups

   Navigate to Admin > Groups.

2. Create the group

   Click New Group, enter a name, and save.

3. Add users

   Open the group and use the Add Users field to search for and add members by email.

4. Assign connectors

   Under the Connectors tab within the group, add the connectors you want to restrict to this group. Only members of this group will be able to see content from those connectors.

Designating curators

A curator can manage a group’s membership and connectors without having full admin access. To designate a curator:

1. Open the group in Admin > Groups.
2. Find the user in the members list.
3. Toggle the Curator switch next to their name.

Curators can add and remove members, attach connectors to their group, and manage agents associated with the group. They cannot access other areas of the Admin panel.

Removing a group

Open the group, click Delete Group, and confirm. Users in the group are not deleted — they simply lose access to any connectors or agents that were restricted to that group.

The system groups Admin and Basic are reserved and cannot be deleted or renamed.

How RBAC controls access

Connectors and agents can be set to public (accessible to all users) or restricted (accessible only to specific groups). When a connector is restricted:

• Only users in the assigned groups can see documents from that connector in search results and chat responses.
• The restriction applies both at indexing time and at query time.

Agents (AI assistants built on top of connectors) can also be restricted to specific groups. A user who is not in the permitted group will not see the agent in their assistant list.

Permission inheritance from source connectors: When a connector has document-level permissions enabled — for example, a Google Drive connector that respects Google’s native sharing settings — Hadiq.io inherits those permissions from the source. A user must both belong to a permitted group and have access to the document in the source system to see it in Hadiq.io.

Group sync via SSO

Automatic group sync from your identity provider requires OIDC or SAML SSO, which is available on the Enterprise plan. On the Business plan, groups are managed manually through the Admin panel.

When OIDC or SAML is configured with group sync, Hadiq.io can automatically add and remove users from groups based on the claims your identity provider sends during login. See SSO and authentication for setup details. For fully automated provisioning, see the SCIM section on that page.