Groups
This is an Enterprise-only feature. The Groups page and policy enforcement are available only to organizations on the Enterprise plan.
Groups let you organize members of your organization and attach policies to them, without creating sub-organizations. Groups are flat (no nesting) and a member can belong to any number of groups.
Model access is the first policy type. It grants models and providers to the members of a group, layered on top of the organization-wide Model Access Controls. More policy types are planned.
Roles
| Role | What they can do |
|---|---|
| Owner | Create, edit, and delete groups; manage members and policies |
| Billing manager | View groups and policy settings (read-only) |
| Member | See the names of the groups they belong to |
Managing groups
Open Groups in your organization's sidebar on the Organization dashboard.
- Click Create group
- Give the group a name and optional description
- Add members
- Add policies
Deleting a group removes the group, its policies, and its member assignments. Members keep whatever access the organization defaults and their remaining groups grant.
Model access policies
A model access policy has one of three modes:
| Mode | Effect |
|---|---|
| All | Grants every model and provider |
| Selected | Grants only the models and providers you select |
| None | Grants nothing |
Policies compose in layers:
- Default policies apply to every direct member before their group policies are combined. Manage them from the Group policies card on the Groups page.
- Group policies apply to the group's members. A member in several groups gets the union of those grants.
A member's effective access is the organization ceiling intersected with the default policies plus the union of their group grants:
- Absence of configuration is never a restriction — if no default or group policy applies to a member, their access is unchanged.
- Group grants cannot exceed the organization-wide Model Access Controls. Models and providers blocked there stay blocked for everyone, and the policy editor marks out-of-ceiling entries as unavailable.
- Only an explicit None mode, or a Selected mode with nothing selected, results in no access.
Policy changes are enforced everywhere members use models, including the extension, the CLI, autocomplete, and the Slack, Discord, Linear, and GitHub integrations.