Organizations and roles
An organization is the home of your people, your bots, and your settings. You create it in the Console when you sign up. You can also join an existing organization with an invitation.
Roles
Every person has one role.
| Role | What the person can do |
|---|---|
| Owner | Manages the organization. Appoints and removes Owners and Admins. |
| Admin | Manages bots, API keys, members, connectors, channels, models, and settings. |
| Builder | Builds and publishes bots, skills, triggers, and Knowledge Bases. Uses the Console assistant. Manages their own API keys. |
| Member | Uses Chat. Does not open the Console. |
| Viewer | Reads. Changes nothing. Made for the CLI and the API. |
A Member who opens the Console sees a short note with a link to the Chat address. The last Owner cannot leave or lose the role.
Builder
A Builder builds bots. A Builder can:
- Open the Console.
- Create and change bots, skills, triggers, and Knowledge Bases, and publish bots.
- Use the Console assistant.
- Test bots and use the models.
- See the sessions they started themselves.
- Create and revoke their own API keys, with at most their own permissions.
- See their own usage.
A Builder cannot open Vaults, Members, Connections, Settings, or Billing. A Builder does not see the API keys, usage, or sessions of other people.
Viewer
A Viewer reads what is not critical and changes nothing. The role is made for the CLI and the API, so the Console shows a Viewer little: the Knowledge Bases, their own API keys, and their own usage. Through the CLI and the API a Viewer reads bots, skills, and Knowledge Bases. A Viewer cannot run bots, create or change anything, or use Chat. A Viewer's API keys can read bots and Knowledge Bases.
Invite people
An Owner or Admin invites people in the Console under Members, with Invite. Enter an email address and pick a role. The person gets an email with a link and joins with one click. Pending invitations show in the Members list as Invited. You can withdraw one.
A person who signs up with a company email can ask the Owners of an existing organization for an invitation. The person does not join by themselves.
Single sign-on
An Owner or Admin of a root organization can let people sign in with the identity provider of the company: Microsoft Entra ID, Google Workspace, or OpenID Connect. Passwords stay the default. See Set up single sign-on.
Groups
Groups decide who can use which Company Bot. An Owner or Admin creates them under Members, Groups, with Create group, and adds people to them. A person can be in several groups.
"All members" is a group that always holds everyone in the organization. You cannot change it. New bots start with it.
Service accounts
A service account is an identity for a program, not a person. Create one under Members, Service accounts, with Create service account. Give it a name, a purpose, and permissions. You can create API keys for it. A trigger can run as a service account.
Audit log
Members, Audit log lists who did what: sign-ins to the Console and Chat, API keys created, revoked, or deleted, and changes to access. It also lists every time an Owner or Admin took access to the Personal bot chats of other people, with the end time. The takeovers cannot be changed or deleted. See Privacy. Changes that GEKI makes to the organization show GEKI as who.
Child organizations
A partner can create child organizations for its customers. A child has no Owner. Its highest role is Admin, and its Admins appoint other Admins. See Partners.