User roles and rights in ZenithAI

ZenithAI has five roles: the server administrator, Admin, User Manager, Organizational Manager and Member. They are listed here from the most to the least authority over accounts and organisations. A Member is an ordinary user. The other four roles add rights for looking after people, organisations or the server. This page is the reference for who can do what; the steps are in Users, roles and administration.

1. 1Server administratorThe one account named at install. Licence, storage, User Managers.
2. 2AdminUsers, organisations and other Admins. Made on the server only.
3. 3User ManagerOrdinary users, from the Users page only.
4. 4Organizational ManagerShared workspaces, people and name of one organisation.
5. 5MemberChat, files, API keys and the workspaces they can use.

What can each role do?

A No is refused by the server itself, even if a person finds another way to ask for it. “Ordinary users” means everyone who is not the server administrator, an Admin or a User Manager.

YesLimited, as written in the cellNo

Rights of each ZenithAI role, from the most authority (left) to the least

Right	1Server administrator	2Admin	3User Manager	4Organizational Manager	5Member
Everyday use
Chat, use workspaces they have access to, create their own API keys	Yes	Yes	Yes	Yes	Yes
Accounts
Add users, one by one or from a CSV file	Yes	Yes Note 1	Yes Note 1	No	No
Place a new person in an organisation as a member	Yes	Yes	Yes	No	No
Reset a password or make a new setup link	Yes	Ordinary users	Ordinary users Note 2	No	No
Suspend an account	Anyone but themselves	Ordinary users and other Admins Note 3	Ordinary users	No	No
Archive an account	Anyone but themselves	Ordinary users and other Admins Note 3	Ordinary users	No	No
Reactivate an account	Yes	Ordinary users	Ordinary users	No	No
Delete an archived account’s data, resume a stopped deletion, restore a chat safety copy	Yes	Ordinary users	Ordinary users	No	No
Clear a person’s chat history	Yes	Ordinary users	Ordinary users	No	No
Switch a person’s internet access on or off	Yes	Yes	Yes	No	No
Roles
Make or remove a User Manager	Yes	No	No	No	No
Create or remove an Admin	Not in the web app Note 4	Not in the web app	No	No	No
Licence and server
Read the Licence page	Yes	Yes	No	No	No
Install a licence key or start the trial	Yes	No	No	No	No
Open the Storage page and its actions	Yes	No	No	No	No
Organisations
Create, archive or restore an organisation	Yes	Yes	No	No	No
Rename an organisation	Yes	Yes	No	Own organisation only Note 7	No
Add an existing account to an organisation (Add people)	Yes	Yes Note 5	No	Own organisation only Note 7	No
Make someone an Organizational Manager, or back to member	Yes	Yes Note 5	No	Own organisation only Note 8	No
Remove someone from an organisation (Remove from Organization)	Suspend the membership instead	Suspend the membership instead	No	Own organisation only Note 8	No
Suspend or restore someone’s membership of an organisation	Yes	Yes Note 5	No	No	No
See an organisation, its people and shared workspaces	All organisations	All organisations	Own organisation only, if a member	Own organisation only	Own organisation only Note 6
Shared workspaces
Create shared workspaces, choose who can use them, view their audit log	Only as an Organizational Manager there	Only as an Organizational Manager there	Only as an Organizational Manager there	Own organisation only	No
Add or delete documents and websites in a shared workspace	Only as an Organizational Manager there	Only as an Organizational Manager there	Only as an Organizational Manager there	Own organisation only	No
Use a shared workspace in chat	If they have access	If they have access	If they have access	Always, in their own organisation	If they have access

Notes on the table:

1. An Admin or User Manager adds ordinary users. The address of an Admin is added only by the server administrator. A User Manager can create up to 200 accounts an hour and make up to 50 resets and setup links in 10 minutes.
2. A User Manager cannot reset the password or make a setup link for an Organizational Manager. The server administrator does that.
3. An Admin cannot suspend or archive the server administrator, a User Manager or themselves. The last active Admin cannot be suspended or archived. Reactivating another Admin, clearing an Admin’s chat history and deleting an Admin’s data are left to the server administrator.
4. The server administrator’s own account cannot be suspended, archived or demoted from the web app.
5. An Admin cannot change the server administrator’s membership of an organisation.
6. A Member sees the workspaces they can use and their Your Organizational Managers, not the other members.
7. An Organizational Manager adds and renames only while the organisation is active. In an archived organisation both are refused until an Admin or the server administrator restores it. Add people takes an existing ZenithAI account only, never the server administrator, an Admin or a User Manager, and the reply is the same whatever happens (see What can an Organizational Manager do?).
8. An Organizational Manager cannot change the role of, or remove, the server administrator, an Admin or a User Manager. They cannot remove themselves, and the last active Organizational Manager can be neither removed nor demoted. A manager may step down while another manager remains.

Which role ranks highest?

The order above follows the rights each role has. One rule in the code ranks the roles slightly differently: when it decides who may lift a suspension, the order is server administrator, User Manager, Admin, Organizational Manager. That is why an Admin cannot lift a suspension a User Manager made, although an Admin can do more elsewhere, such as acting on other Admins and on organisations.

Who is the server administrator?

The server administrator is shown in the app as server admin. It is the one account whose email address was given as the administrator’s email when ZenithAI was installed, and it sets its own password at first sign-in. There is only one. It cannot be suspended, archived or demoted from the web app, and only the server administrator installs a licence key, starts the trial, makes User Managers and uses the Storage page. “Super admin” is a common name for this role; the app itself says server admin.

Who can create Admins?

Nobody can, in the web app. Your server team makes or removes an Admin on the server, with the administrator list in the server’s settings or the server’s account command line tool. An Admin looks after users, organisations and other Admins, and reads the licence page. The key limit: an Admin cannot touch the server administrator, cannot act on a User Manager, and cannot install a licence key.

What can a User Manager do?

A User Manager is an ordinary user who also looks after accounts, for example someone in HR or at a branch. The server administrator gives the role on the Users page with Make User Manager, and takes it back with Remove User Manager. A User Manager sees Users in the menu and no other admin page.

What can a User Manager not do?

A User Manager works on ordinary users only. They cannot change an Admin, the server administrator, another User Manager or their own account, cannot reset an Organizational Manager’s password, and cannot lift a suspension the server administrator made. They cannot open the licence, the organisations or any other admin page, and they cannot give any role. See User Managers for the limits on how many accounts they can create.

What can an Organizational Manager do?

An Organizational Manager runs one organisation and is an ordinary user in every other way. An Admin or the server administrator gives the role on the Organisation screen, in Users in Organization, and an Organizational Manager can give it to others in the same organisation. In their own organisation they can:

• Add people. Click Add people, type the full email address of someone who already has a ZenithAI account, and click Add. The person joins as a member. The reply is always the same, If an account with this address can be added, it is now a member of this organisation., so it never says whether an address exists, is suspended or belongs to an Admin. The list below shows who is now in the organisation. A person who has never signed in has no account yet and cannot be added.
• Change a role. Use the ⋮ menu on a person and choose Make Organizational Manager or Make member. On their own row the choice is Step down to member. Making someone a manager means a User Manager can no longer reset their password or send them a setup link. Access given on a single workspace is not changed by a role change.
• Remove people. Choose Remove from Organization in the ⋮ menu. A window names the person and the organisation and takes an optional reason, which is kept in the audit record. The person loses access to the organisation’s shared workspaces. Their ZenithAI account is not suspended, their other organisations and their own chats are not affected, and the knowledge they added stays with the organisation. They can be added back with Add people, as a member, without their earlier workspace access.
• Rename the organisation. Click the organisation’s name, which opens Details and name, change the name (up to 60 characters) and click Save name. If someone changed the organisation in the meantime, ZenithAI says Organization changed; reload before saving. and you save again.
• Run the shared workspaces. Create workspaces, choose who can use each one (Everyone in the organisation or Only selected people), add and delete documents and websites from Organisation Knowledge, and open the audit log with View audit.

Adding, role changes and removals are limited in number, and every attempt is recorded in the audit log. If the audit log cannot be written, the action is refused.

What can an Organizational Manager not do?

• Work outside their own organisation. Another organisation’s name, people and workspaces are not shown, and any attempt gets the same “not found” answer.
• Use any of this in an archived organisation. Adding people, changing roles and renaming are refused, and the page says the organisation is archived. An Admin or the server administrator restores it.
• Create, archive or restore an organisation, or remove the server administrator, an Admin or a User Manager from one. They also cannot change the role of those people.
• Remove themselves. The last active Organizational Manager cannot be removed or demoted, so ask another manager or an Admin first. A manager may remove or demote another manager.
• Suspend, reactivate or archive an account, delete its data or clear its chat history. These affect the whole account, not just the organisation, so Admins, User Managers and the server administrator do them. In a person’s Account window an Organizational Manager sees the status and Remove from Organization only.
• Create accounts. Add people works only for accounts that already exist.

Suspensions an Organizational Manager made earlier stay in force until an Admin, a User Manager or the server administrator lifts them.

What can a Member do?

A Member is the ordinary user. They chat, create files and API keys, and use the shared workspaces of their organisation that they have access to. They see their organisation’s name and Your Organizational Managers, but not the other members. To get access to a workspace, they ask an Organizational Manager.

Who can lift a suspension?

A suspension can be lifted by someone at the same level or higher. The levels, lowest first, are Organizational Manager, Admin, User Manager and server administrator. So an Admin cannot lift a suspension a User Manager or the server administrator made.

Archiving does not get around this. If a person’s suspension came from a more senior level, ZenithAI refuses to archive them, so nobody can archive and then reactivate to undo it. You can archive a person whose suspension was made at your own level, or by an Organizational Manager.

Related pages

• Users, roles and administration: add people, import a CSV file, suspend, archive, internet access and the audit log.
• Organisations and Organizational Managers: how organisations are set up.
• Workspaces: how shared workspace documents are used in chat.
• Licensing and the free trial: who installs the licence key.

Common questions

What roles does ZenithAI have?

ZenithAI has five roles, from most to least authority over accounts and organisations. They are the server administrator, Admin, User Manager, Organizational Manager and Member. Member is the ordinary user.

Who can create an Admin in ZenithAI?

Nobody can create an Admin in the web app, not even the server administrator. Your server team adds or removes administrators on the server, through the administrator list in its settings or the server's account command.

What can an Admin do that a User Manager cannot?

An Admin can also suspend and archive other Admins, create, rename, archive and restore organisations, add people to them and read the Licence page. A User Manager works on ordinary users from the Users page only.

What can an Organizational Manager do?

An Organizational Manager runs one organisation. They add existing accounts by email, make people managers or members, remove people from the organisation, rename it, and manage its shared workspaces and documents. They cannot suspend or delete accounts.

Who can install a licence key?

Only the server administrator installs a licence key or starts the 30-day trial. Admins can open the Licence page and read it, and their page says that only the server admin installs a key.

Can an Admin lift a suspension made by the server administrator?

No. A suspension can be lifted only at the same level or higher. Archiving the person and then reactivating them does not get around this, because ZenithAI refuses the archive while a more senior suspension is in force.