Common Administration Tasks

Step-by-step instructions for the tasks administrators perform most often in the Admin workspace. Each task lists the permission it requires; if you lack a permission, the corresponding button or tab is hidden.

All of these tasks start from the Admin workspace: open the workspace picker in the top bar and choose Admin under the System group.

Tip

Access in Enprivacy is always granted through the chain user → team → role → workspace. If someone cannot see something they should, check each link: are they in a team, does the team have a role with the right permissions, and is the team attached to the right workspace?

Invite a new user

Requires admin.users:invite.

1. Choose Invite user in the Admin header (or from Manage → Users).
2. Enter the person’s email address and choose Send invite.
3. The confirmation reads: “{email} can now sign in. Add them to teams to grant access.” — the invite only creates the identity. Continue with Add a user to a team, or the person will be able to sign in but see nothing.

Add a user to a team

Requires admin.users:update or admin.teams:update.

1. Go to Manage → Users and open the user from the Catalogue tab.
2. In the Teams section, choose Link team.
3. Search for the team and confirm.

You can equally work from the other side: open the team under Manage → Teams and use Link member in its Members section. The user immediately inherits the team’s roles in every workspace the team is attached to.

Grant access to a workspace

Requires admin.teams:update (and, if new records are needed, admin.teams:create, admin.roles:create).

Workspace access is granted to teams, never to individual users. To give a team’s members access to a workspace:

1. Go to Manage → Teams and open the team.
2. Check the Roles section — the team must hold at least one role, or its members will reach the workspace with no permissions. Use Link role if needed.
3. In the Workspaces section, choose Link workspace, search for the workspace, and confirm.

To grant one person access, first add them to a suitable team (above), or create a new team for the purpose (below).

To revoke access, open the team and remove the workspace from its Workspaces section — you will be asked to confirm: “Remove this team’s access to the workspace?” Every member loses that reach at once.

Create a team

Requires admin.teams:create.

1. Choose Add team in the Admin header (or from Manage → Teams).
2. Fill in Team details: name, description, and the team owner.
3. Save, then from the team’s detail page: Link role to give the team its permissions, Link member to add users, and Link workspace to set its reach.

A team with no role or no workspace grants nothing; such teams are flagged in the Teams overview under No role and No workspace.

Create a role

Requires admin.roles:create.

1. Choose Add role in the Admin header (or from Manage → Roles).
2. Fill in Role details (name, description).
3. In the Permissions section, tick the actions to grant, grouped by domain. The available actions come from the read-only permission registry.
4. Save, then assign the role to teams — from the role’s detail page via Link team, or from each team’s Roles section.

Caution

A role exists once across the platform. Editing its permissions immediately affects every team that holds it, in every workspace those teams reach. Review the role’s Teams and Users reached lists before editing.

Create a workspace

Requires admin.workspaces:create.

1. Go to Manage, then open the Workspaces catalogue at /admin/workspaces, and choose Add workspace.
2. Enter a name and description and save. This starts the workspace’s first-run setup.
3. Attach at least one team from the workspace’s detail page (Link team) so someone can reach it.
4. Configure default AI models, plans, and content links inside the workspace itself — the Admin area only manages the catalogue entry and team access.

The Workspaces overview flags incomplete setups: Without team, Without AI model, Without chat plan.

Remove a user’s access

Requires admin.users:update or admin.teams:update.

• From one team: open the user (or the team) and remove the membership row. The user loses that team’s roles and workspace reach immediately.
• From everything: remove the user from every team listed on their detail page. A user with no team has no access, but their identity and audit history remain.

Memberships, role assignments, and workspace grants are soft-deleted — re-linking later restores the original record, and both the removal and the restore are recorded in the audit log.

Grant or revoke super admin

Super admins only.

1. Go to Manage → Users and open the user — you cannot change this flag on yourself.
2. Choose Edit, toggle the super admin switch, and save.

The switch’s own description states the stakes: “Grants unrestricted access to every surface, bypassing all permission checks. Changing this is recorded in the audit log.” Grant it sparingly; day-to-day administration should run through admin.* permissions instead.

Review audit activity

Requires admin.audit_logs:show.

1. Choose Audit Logs in the Admin navigation strip.
2. Use the filter shelf to narrow by time, category, event type, actor, subject, workspace, or IP address — or search across event types, IPs, request IDs, and metadata.
3. Open any event for the full record, including request and session identifiers and raw metadata.

Typical checks: filter category security for blocked logins; filter by actor to review an administrator’s changes; filter by subject to trace the history of one user, team, role, or workspace.