In a managed organization, groups bring members together, roles define what each person can do in the admin console, and labels describe members so you can build groups and rules on them. These three pages of the admin console only exist when the organization functions are turned on.
GroupsLink to the Groups section
A group brings members together by team, site, class or level. Each group can have its own managers, rules, models and instructions.
Create a groupLink to the Create a group section
- Admin console › “Groups” › “New group”.
- Enter a “Name” and, if you want, a “Description”.
- Under “Group membership”, choose how the group is filled: - “Manual”: you add and remove members yourself, or through an import; - “Label-based”: members whose labels match the group’s rule join and leave on their own.
- Click “Create group”.
Dynamic group ruleLink to the Dynamic group rule section
The rule of a “Label-based” group is set on the group’s page, in the “Members” tab.
- “All of these labels”: the member must carry each of the listed labels.
- “And at least one of these labels”: the member must also carry one of them.
Before you save, the “With the edited rule” preview shows the members the rule would include. “Save rule” applies it. With no condition, the group stays empty. You can also add a member by hand to a dynamic group: they stay in it until someone removes them.
The group pageLink to the The group page section
A group’s page has four tabs.
| Tab | Contents |
|---|---|
| “Members” | The members, added by hand or “By rule”, with “Add members” |
| “Rules” | Each setting follows the organization, or is allowed or denied for the group’s members |
| “Models” | The models offered to the group’s members |
| “Instructions” | The “Group instructions”, which Moon AI reads after the organization’s instructions |
In the “Members” tab, each row’s menu offers “Make” followed by the name of the manager role (for example “Make Manager”), to make that member a manager of the group, and “Remove from group”. Only the people who manage groups across the whole organization can appoint or remove a manager.
A group’s rules do not apply to its managers. Rules are described in Organization rules.
A group created by your directory is marked “From the directory”: its members follow the directory, and it is edited from the directory. See SCIM directory.
Delete a groupLink to the Delete a group section
Group row menu › “Delete”. Its members stay in the organization; the group’s rules and instructions stop applying to them.
My groupsLink to the My groups section
A group manager does not open the admin console. They get “My groups” instead, in the workspace menu and in “Settings” › “Your workspace”.
- The list shows the groups they manage, with their number of members and the share of the monthly limit used this month.
- A group’s page shows its members (“Add members”, “Remove from group”; the first 200 are shown), their “Usage this month” and the tokens of the last 30 days. The manager edits the “Group instructions” there; the “Group rules” are read-only.
Removing a member from the group does not remove them from the organization. The group’s rules are edited in the admin console, on the group’s page.
RolesLink to the Roles section
Roles define what each person can do in the admin console. They add up: a person holds every permission of all their roles. Roles also carry rules and instructions for the people who hold them.
Built-in rolesLink to the Built-in roles section
| Role | What it allows |
|---|---|
| Owner | Every permission, including deleting and transferring the organization. |
| Admin | Every permission, except deleting or transferring the organization and managing billing. |
| Manager (name depends on the type) | Sees and manages the members, labels, instructions and usage of the groups they manage. |
| Billing contact | Sees the contract, the invoices and the licenses. |
| Member (name depends on the type) | Uses Moon AI and sees their own usage. |
The owner, the admins and the members hold this role through their base role. The permissions of built-in roles cannot be changed; their rules and instructions can.
Create a roleLink to the Create a role section
- Admin console › “Roles” › “New role”.
- Enter a “Name” and, if you want, a “Description”.
- Tick the permissions. For each one, choose its scope: “Whole organization”, “Groups they manage” or “Only themselves”, depending on what the permission accepts.
- Click “Create role”.
You cannot give a permission you do not have yourself: “You cannot grant permissions you do not have yourself. Remove them or narrow their scope.”. Deleting and transferring the organization stay reserved to the owner and are never granted by a role.
A person with at least one permission over the “Whole organization” opens the admin console. A group manager whose permissions are limited to “Groups they manage” gets “My groups” instead.
PermissionsLink to the Permissions section
| Area | Permission | Possible scopes |
|---|---|---|
| The organization | “Change organization settings” | Whole organization |
| “Delete organization”, “Transfer organization” | Owner only | |
| Billing | “View contract and invoices”, “Manage billing”, “View member licenses”, “Manage member licenses” | Whole organization |
| Members | “View members”, “Invite members”, “Suspend members”, “Remove members” | Whole organization, groups they manage |
| “Import members”, “Assign roles to members” | Whole organization | |
| Roles | “Create and edit roles” | Whole organization |
| Groups | “Create groups”, “Delete groups”, “Set group rules” | Whole organization |
| “Manage group members”, “Write group instructions” | Whole organization, groups they manage | |
| Organization labels | “Create and edit labels” | Whole organization |
| “Apply labels to members” | Whole organization, groups they manage | |
| Rules and resources | “Set organization rules”, “Choose models”, “Manage connectors”, “Manage storage”, “Manage shared library”, “Publish to the catalog” | Whole organization |
| Usage | “View usage” | Whole organization, groups they manage, only themselves |
| “Export usage” | Whole organization, groups they manage | |
| Security and compliance | “Manage security”, “Manage admin API keys”, “View audit log”, “Export audit log” | Whole organization |
The page each permission opens is listed in Navigation.
Assign a roleLink to the Assign a role section
- Admin console › “Roles”, “Who holds which role” section › “Assign a role”.
- Choose the role, then who gets it: “A member”, “A group” or “A label”.
- Click “Assign role”.
A role given to a group or a label applies to all its members, now and later. A group that comes from your directory takes its roles from the directory. The menu of an assignment offers “Remove role”. You can also give a role from the “Members” page, row menu › “Add or remove a role”.
The role pageLink to the The role page section
| Tab | Contents |
|---|---|
| “Rules” | Each setting follows the organization, or is allowed or denied for the people who hold the role |
| “Permissions” | The role’s permissions. Those of a custom role are edited on the “Roles” page. |
| “Instructions” | The “Role instructions”, read by Moon AI after the organization’s instructions and before the groups’ instructions |
The page also lists the members who received the role, directly or through their groups and labels. Deleting a custom role immediately removes its permissions from the people who held it.
LabelsLink to the Labels section
A label describes a member with a key and a value, for example site and Lyon. Dynamic groups and rules are built on labels.
Create a labelLink to the Create a label section
- Admin console › “Organization labels” › “New label”.
- Enter the “Key” and the “Value”, then choose a “Color”. “Existing keys” suggests the existing keys.
- Under “Used for”, choose: - “Members”, to describe people; - “Shared resource sensitivity”, to mark knowledge bases, agents and shared files, and control who can access them.
- Click “Create label”.
Put on or take off a labelLink to the Put on or take off a label section
Each label’s menu offers “Apply to members”, “View members”, “Remove from all members”, “Edit” and “Delete”. You can also put a label on members from the “Members” page (row menu › “Organization labels”, or by selecting several members) and through the CSV import.
Taking a label off every member leaves them their account and the groups chosen by hand; the dynamic groups built on that label lose them. A label used by a dynamic group’s rule cannot be deleted: change that rule first.
Labels pushed by your directory are marked “From the directory”.
See alsoLink to the See also section
- Organization rules
- Groups, Roles and Labels in the Organizations API