People, groups and access
Invite colleagues, organize them into groups, and understand how access to services, workspaces and data is granted.
On this page7 sections
Invite a person#
- Open Settings, then People, and click Invite.
- Enter their Email address and choose a role: Member or Admin.
- Click Send invitation.
The address appears under Invited, not yet joined until they accept. An invitation is valid for 30 days, and one reminder is sent shortly before it expires. To cancel an invitation, click the X beside it.
Change a person's role#
On Settings, People, change the person's role between Member and Admin and click Save on their row.
You cannot change your own role, and an organization always keeps at least one admin.
See what a person can reach#
Click View permissions on a person's row to see the services they have been given access to directly, and the groups they are in. It lists direct access only; what they get through a group or through the whole organization is on top of that.
If any service has been given to nobody, a banner on the People page says how many, with a button to open them to everyone in the organization.
Groups#
A group is a named set of people who are given access together.
- Open Settings, then Groups, and click New group.
- Type a name and click Create group.
- Open the group, click Add person, add each person, and click Done.
The built-in Everyone group always contains every member.
To give a group access to a service, open the service's Access tab, click Add person or group, add the group, set its level and click Save changes.
To remove a group, open it and click Archive this group. Access given through the group is withdrawn. Access people were given directly stays.
Groups cannot be renamed, and each needs a name of its own.
How access works#
Access in Refactor is always something that was granted. Nothing is open by default.
| Thing | Starts as | Opened by |
|---|---|---|
| Workspace | Private to its owner. | The owner or an admin, with Share. See Share, clone and archive. |
| Service | Private to its creator and admins. | Whoever manages its access, on the service's Access tab. See Services. |
| Engagement | Its workspace is private to the person who started it. | That person, by sharing the workspace. |
| Data source | Private to its creator. | Whoever manages it, with Share. See Data sources. |
Three rules apply everywhere.
- Access adds up. A person has the most they have been given across their own access, their groups and everyone in the organization. Nothing subtracts, so nobody can have less than what everyone has.
- Being on call is not access. On call decides who is asked when work needs a person. It gives nobody the ability to open anything.
- A change takes a moment to reach an open tab. Someone who already has a workspace open can keep working for up to 30 minutes after their access changes, unless they reload.
What admins can see#
An organization admin has full access to every service and its engagements' records.
For private workspaces and private data sources, an admin can see that they exist and what they are called, but not what is in them. To look inside, an admin grants themselves access. That grant is recorded as an admin granting themselves access.
Nobody but you, admins included, can reach your personal workspace or see what Fibo remembers about you.
Connections admins set up#
Some things are connected once for the whole organization, under Settings:
- Storage: Google Drive, Microsoft SharePoint and GitHub. See Client folders and GitHub repositories.
- Models: which AI models may be used, and spending limits. See Models and spending.