> For the complete documentation index, see [llms.txt](https://docs.artific.nl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.artific.nl/en/for-administrators/access.md).

# Users and access

Who can use the platform, and what they are allowed to do. Found under **User management**.

## How access works

Rights are not given to people directly. The chain is:

```
User  →  User group  →  Role  →  Rights
```

| Step                                                                     | What it means |
| ------------------------------------------------------------------------ | ------------- |
| A **user** is a person with an account.                                  |               |
| A user belongs to one or more **user groups**.                           |               |
| A group carries one or more **roles**.                                   |               |
| A role grants **rights**: what may be done in each area of the platform. |               |

Someone's effective rights are everything granted by every role on every group they belong to. Rights add up; they never subtract.

{% hint style="warning" %}
This is the part administrators most often get wrong. Editing a user does not change their rights. There is nowhere to do that. **Group membership is the only lever.** To give someone access, add them to a group that has it.
{% endhint %}

## Why it works this way

It looks indirect for one person and pays off with fifty. Access is described once, as a role, and applied by membership. Onboarding becomes "add to these three groups" instead of a permissions review, and when a role changes, everyone in it changes with it.

## The pages

| Page                                                                  | What you do there                                                        |
| --------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| [Users](/en/for-administrators/access/users.md)                       | Create people, edit them, import in bulk, manage their group membership. |
| [User groups](/en/for-administrators/access/user-groups.md)           | Create groups and decide which roles they carry.                         |
| [Roles and rights](/en/for-administrators/access/roles.md)            | Define what a role allows.                                               |
| [Service accounts](/en/for-administrators/access/service-accounts.md) | Accounts for software rather than people.                                |

## Setting it up the first time

1. **List the kinds of people** you have: everyday users, assistant builders, administrators, perhaps a support team.
2. **Check the roles you already have.** The platform provides ready-made ones covering the common cases: an administrator role, an assistant user role, Toolbox user and admin roles. Most organisations need nothing more.
3. **Create one group per kind of person**, and attach the appropriate role to each.
4. **Add people to groups.**
5. **Set default groups** in [Organization settings](/en/for-administrators/organization/settings.md) so new users land somewhere sensible.

Name groups after the people in them (*Support team*, *Assistant builders*, *Everyone*), not after the rights they carry. The rights will change; the group's purpose usually will not.

## Reviewing access

* When someone changes job, change their groups. Nothing else needs touching.
* When someone leaves, delete them from the organisation.
* Review group membership periodically, particularly for groups with administrator rights.
* Keep the number of groups small enough that you can explain the whole model in a minute. Twenty overlapping groups is how organisations lose track of who can do what.