> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.alephant.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.alephant.io/_mcp/server.

# Users, Groups & Roles

> Manage people and groups, share resources deliberately, and preserve the boundary between Admin and Curator work.

Access management should give each person the least access needed for their work. Admins define deployment-wide boundaries; Curators manage group-scoped Agents, connectors, and document sets, while their MCP and OpenAPI Actions remain owner-scoped.

## Roles

| Role           | Primary responsibility                                                                                                                       | Boundary                                                                                                              |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| Admin          | Manage deployment-wide configuration, access rules, and organization settings.                                                               | Owns sensitive configuration and may delegate only the access required for a task.                                    |
| Curator        | Manage Agents, connectors, and document sets for groups for which they are a curator; create and maintain their own MCP and OpenAPI Actions. | Group responsibility does not grant ownership of another person's Action or deployment-level configuration authority. |
| Global Curator | Manage Agents, connectors, and document sets for groups of which they are a member; create and maintain their own Actions.                   | Global Curator status expands group-resource coverage, not Action ownership or deployment-level authority.            |
| User           | Use resources that have been shared with them.                                                                                               | Cannot change deployment-wide settings or expand the resource scope that was shared.                                  |

## Manage users

An Admin should add, remove, or update people only through the deployment's available user-management controls. Confirm the person's identity and intended responsibility before granting access, remove access when it is no longer needed, and review inactive accounts regularly.

Visible user-management controls depend on the deployment configuration and identity setup. Do not assume that a menu shown in one deployment is enabled in another.

## Manage groups

Use groups when several people need the same resource access. Give groups clear names that identify their purpose, keep membership current, and avoid using a broad group when a smaller group or individual share is sufficient.

Groups organize access assignments; they do not replace the deployment's role boundaries or a connected service's own permission checks.

## Share resources

Share an approved Agent or other available resource with the intended user or group, then verify the resulting experience as a member of that audience. Remove the share when the work ends or when the audience changes.

Sharing a resource makes its approved configuration available to the chosen audience. It does not grant that audience Admin permissions, allow it to edit the resource, or provide unrestricted access to connected services.

## Curator boundaries

Curators can manage Agents, connectors, and document sets for groups for which they are a curator. Global Curators can manage those group-scoped resources for groups of which they are members. Both roles can create MCP and OpenAPI Actions but can modify, delete, or maintain protected credentials only for Actions they created; Global Curator status does not expand Action ownership.

A Curator can attach a currently available Action to any Agent they can edit. They should request an Admin change for another owner's Action, deployment-level models, Index Settings, organization-wide integrations or security, Usage, and organization-wide access rules.

## Verify access

Test access with a representative account for each intended role or group. Confirm that the intended people can find and use the shared resource, people outside the share cannot, and Curators cannot reach deployment-wide settings unless they were explicitly assigned an Admin role.

## Related pages

* [Admin Panel & Roles](/opencore/admin-panel-and-roles) explains the primary Admin and Curator entry points.
* [Manage Agents](/opencore/agents/agents) explains how Agents are published and shared.
* [Usage, Identity & Security](/opencore/governance/usage-and-security) explains identity and security controls that may affect access.