Admin Rights and Group Admins

Organization admins can do everything in the Organization section of Settings. With admin rights, other people can take over parts of this work, either for the whole organization or for one group. A department can, for example, see the usage and the audit log of its own group and add people to it without anyone in it becoming an organization admin.

Organization Admins and Admin Rights#

• Admin rights for the whole organization also apply to every group.
• One person can have admin rights for the whole organization and for several groups. For a group, the areas of both add up.
• A group admin does not have to be a member of the group.
• Unlike roles, admin rights belong to one organization. If the person also belongs to another organization, they have no admin rights there unless they are given some there as well.
• Organization admins always have every right. They are not listed as group admins and cannot be given admin rights.

Areas#

Admin rights consist of one or more of these areas:

With admin rights for a group, each area covers only that group: the usage and the audit log of its members, its members on the People page, its members’ Relays and the group itself on the Groups page.

What Stays with Organization Admins#

Admin rights never include the following. They stay with people who have the Organization admin role:

• the Models, Document style and API keys pages,
• inviting people,
• assigning roles and changing a person’s groups in their details,
• the account actions, such as Disable and Remove from organization,
• creating, renaming and deleting groups, and choosing whether a group is shown in sharing dialogs.

If someone needs all of this, give them the Organization admin role instead (see Roles).

Pages You See with Admin Rights#

Giving Someone Admin Rights for a Group#

To change a group admin’s areas, select Change in their row, adjust the areas and select Save. To take away the admin rights, select Remove and confirm. The person stays a member of the group if they are one. Unticking every area under Change and saving removes the rights as well.

The Admins tab shows only the areas given for this group. Organization admins and people with admin rights only for the whole organization are not listed, even though their rights apply to the group too.

Giving Someone Admin Rights for the Whole Organization#

Change appears only if you are an organization admin or have admin rights for the whole organization yourself, and only for people who are not organization admins.

Admin rights in a person’s details shows the person’s current rights: Organization admin for people with this role, No admin rights, or one line for Whole organization and one for each group, each with its areas. Rights for a group are changed in the group’s Admins tab.

Who Can Give Admin Rights#

Organization admins can give, change and remove any admin rights. People with admin rights can appoint further admins themselves, within limits:

• Only within their own scope. With admin rights for a group, you can give admin rights for this group only. With admin rights for the whole organization, you can give admin rights for the whole organization and for every group.
• At most with their own areas. In the dialog, areas you do not have yourself cannot be ticked, and AITEZA notes: “You can only grant areas you hold yourself.”
• Nobody can change rights above their own. If someone has an area that you do not have in that scope, Change and Remove are not shown for them.

Every change is recorded in the Audit Log under Administration as Admin rights granted (also when areas are changed) or Admin rights revoked. The event details name the scope (organization or group), the group, the new areas (areas) and the previous ones (previousAreas) as area codes (see For Platform Operators).

What Group Admins See#

The Group Selector#

On the Usage, Audit log and People pages, a Group selector at the top chooses what the page shows:

• Whole organization, offered if you have the page’s area for the whole organization,
• each group for which you have the page’s area.

If you have the area for the whole organization, you can choose every group. Organization admins can therefore use the selector as a group filter. If there is only one choice, for example a single group, the selector is not shown and the page description names the group instead, for example “What the requests of the current members of Sales to AI models cost, per month.”

The chosen group is part of the page address, so a bookmark or a shared link opens the page with the same group.

Current Members Only#

With a group selected, the pages show only the people who are members of the group right now:

• Usage: the usage of the current members in the whole selected month, even if they joined the group later in the month. People who have left the group are not included, not even for past months. Relays and system tasks are not included either, so the figures of all groups do not add up to the organization’s total. Total, forecast, Cost per day and the By model tab are calculated from the members’ usage only. Export CSV exports the members’ rows. See Organization Usage.
• Audit log: the events of the current members, including events from before they joined the group. Events of former members are not shown. The Person filter offers only the group’s members. See Audit Log.
• People: only the group’s members, with search and status filter as usual.

Read-Only Person Details#

Anyone who is not an organization admin sees the People page and the person’s details read only:

• there is no Invite people button and no menu at the end of the rows,
• groups and roles are shown as text and cannot be changed,
• the Account section with the account actions is missing,
• the Activity tab is shown only if you also have Audit log for what the page shows: the whole organization or the selected group,
• Admin rights shows the person’s rights for the whole organization. If you have People & access only for some groups, it shows the person’s group rights only for these groups.

Groups for Group Admins#

On the Groups page, people who are not organization admins see:

• every group, if they have People & access or Manage members for the whole organization, otherwise only the groups they have admin rights for,
• no New group button and no Models column.

A group’s side panel shows only the tabs your areas allow:

Managing Members#

With Manage members you add people to a group and take them out again.

Remove next to a member takes them out of the group. They stay in the organization and keep their account; they only lose the access they had through the group.

Group admins cannot invite new people. If someone does not belong to the organization yet, ask an organization admin to invite them first (see People and Groups).

For Platform Operators#

AITEZA stores admin rights only in Keycloak, not in its own database, as the multi-valued group attribute admins:

• on the organization’s tenant group /tenants/<tenant> for admin rights for the whole organization,
• on the group (a direct subgroup of the tenant group) for admin rights for that group.

Each value holds the rights of one person: <keycloakUserId>:<area>[,<area>…], for example 0b6c5a2e-4f1d-4c8a-9e2b-7d3f1a6c8e90:audit,usage. AITEZA writes the area codes in lower case and sorted:

• The settings pages are the normal way to change admin rights: they apply the rules above and record every change in the audit log. You can also edit the attribute by hand in the Keycloak admin console (the group’s Attributes tab); such changes are not recorded in the AITEZA audit log.
• Unknown area codes are ignored, as are values without a valid user ID or without any known area. Several values for the same user ID are combined.
• People with the tenant_admin or super_admin role have every right and need no value.
• Only Keycloak administrators can edit group attributes; the account console cannot. Nobody can give themselves admin rights.
• Changes can take up to 30 seconds to apply on other backend instances, because each instance keeps the rights in memory for that long. The instance that made a change applies it right away.
• When someone is removed from the organization through AITEZA, their values are removed from the tenant group and all its groups. Values of people removed by hand in Keycloak stay but are ignored. They apply again only if the person is added back by hand in Keycloak; adding the person back through AITEZA clears them first.
• Deleting a group deletes its attribute with it, so its group admins lose their rights for the group.
• Writing the attribute changes only admins; other attributes such as name and addons stay as they are. The backend’s Keycloak client needs no permissions beyond those it already needs for managing groups.