> ## Documentation Index
> Fetch the complete documentation index at: https://hadiqio.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Users and permissions

> Manage user accounts, assign roles, organize users into groups, and control access to connectors and agents.

Hadiq.io uses role-based access control (RBAC) to determine what each user can see and do. This page covers how to invite users, change their roles, organize them into groups, and understand how permissions flow through the system.

## User roles

Every Hadiq.io user has exactly one role. The role controls which admin features they can access and which content they can view.

| Role               | Description                                                                                                       |
| ------------------ | ----------------------------------------------------------------------------------------------------------------- |
| **Admin**          | Full access to the Admin panel. Can manage users, configure connectors, set up LLMs, and access analytics.        |
| **Basic**          | Standard user access. Can chat, search, and use agents they have been granted access to.                          |
| **Curator**        | Can manage groups they have been designated as curator of, including adding connectors and users to those groups. |
| **Global Curator** | Can manage all groups they are a member of, without full admin access.                                            |
| **Limited**        | Restricted access to a limited set of API endpoints. Used for service accounts and integrations.                  |

<Note>
  Admins cannot demote their own account from the Admin role. Another admin must make that change.
</Note>

## Inviting users

<Steps>
  <Step title="Open the Users panel">
    Go to **Admin** > **Users**.
  </Step>

  <Step title="Invite by email">
    Click **Invite Users**, then enter one or more email addresses — one per line or comma-separated.

    If email is configured on your instance, Hadiq.io sends an invitation to each address. Users can sign up and immediately access the workspace.
  </Step>

  <Step title="Confirm the invite">
    Invited users appear in the **Invited** tab until they accept and sign up, at which point they move to the **Active** tab.
  </Step>
</Steps>

<Tip>
  You can download the full user list as a CSV from **Admin** > **Users** using the **Download CSV** button. The file includes each user's email, role, and activation status.
</Tip>

## Changing a user's role

<Steps>
  <Step title="Find the user">
    Go to **Admin** > **Users** and locate the user by email using the search field.
  </Step>

  <Step title="Update the role">
    Click the role dropdown next to the user and select the new role.
  </Step>

  <Step title="Confirm the change">
    The role updates immediately. If you are demoting a Curator, Hadiq.io automatically removes their curator relationship from all groups before applying the new role.
  </Step>
</Steps>

## Deactivating and deleting users

To prevent a user from signing in without permanently removing their data, deactivate the account first. Deactivated users cannot log in but their chat history and contributions remain intact.

<Steps>
  <Step title="Deactivate the user">
    Go to **Admin** > **Users**, find the user, and click **Deactivate**.
  </Step>

  <Step title="Delete the user (optional)">
    Once the account shows as inactive, click **Delete User** to permanently remove it. This action is irreversible.
  </Step>
</Steps>

<Warning>
  You cannot delete an active user. Deactivate the account first.
</Warning>

## Groups

Groups let you bundle users together and then grant the group access to connectors and agents. When a connector is restricted to specific groups, only members of those groups can see documents from that connector in search and chat results.

### Creating a group

<Steps>
  <Step title="Go to Groups">
    Navigate to **Admin** > **Groups**.
  </Step>

  <Step title="Create the group">
    Click **New Group**, enter a name, and save.
  </Step>

  <Step title="Add users">
    Open the group and use the **Add Users** field to search for and add members by email.
  </Step>

  <Step title="Assign connectors">
    Under the **Connectors** tab within the group, add the connectors you want to restrict to this group. Only members of this group will be able to see content from those connectors.
  </Step>
</Steps>

### Designating curators

A curator can manage a group's membership and connectors without having full admin access. To designate a curator:

1. Open the group in **Admin** > **Groups**.
2. Find the user in the members list.
3. Toggle the **Curator** switch next to their name.

Curators can add and remove members, attach connectors to their group, and manage agents associated with the group. They cannot access other areas of the Admin panel.

### Removing a group

Open the group, click **Delete Group**, and confirm. Users in the group are not deleted — they simply lose access to any connectors or agents that were restricted to that group.

<Warning>
  The system groups **Admin** and **Basic** are reserved and cannot be deleted or renamed.
</Warning>

## How RBAC controls access

Connectors and agents can be set to **public** (accessible to all users) or **restricted** (accessible only to specific groups). When a connector is restricted:

* Only users in the assigned groups can see documents from that connector in search results and chat responses.
* The restriction applies both at indexing time and at query time.

Agents (AI assistants built on top of connectors) can also be restricted to specific groups. A user who is not in the permitted group will not see the agent in their assistant list.

<Note>
  **Permission inheritance from source connectors**: When a connector has document-level permissions enabled — for example, a Google Drive connector that respects Google's native sharing settings — Hadiq.io inherits those permissions from the source. A user must both belong to a permitted group *and* have access to the document in the source system to see it in Hadiq.io.
</Note>

## Group sync via SSO

<Note>
  Automatic group sync from your identity provider requires OIDC or SAML SSO, which is available on the **Enterprise** plan. On the Business plan, groups are managed manually through the Admin panel.
</Note>

When OIDC or SAML is configured with group sync, Hadiq.io can automatically add and remove users from groups based on the claims your identity provider sends during login. See [SSO and authentication](/admin/sso-authentication) for setup details. For fully automated provisioning, see the SCIM section on that page.