Skip to main content
Groups and roles control access to your organization. Members belong to groups, each group is granted one or more roles that define its permissions, and groups can be given access to specific projects. This lets you grant the right level of access to the right people, scoped to the right projects.
Availability: Managing groups and roles is available to private organizations. The controls appear under Settings → People for members whose role allows managing access (for example, an administrator).

How access works

Access is layered, from the organization down to individual projects:
ConceptWhat it is
OrganizationThe top-level tenant that contains your members, groups, projects, and resources.
MemberA person (or service account) in the organization.
GroupA collection of members, granted one or more roles. Members get their permissions through the groups they belong to.
RoleA predefined set of permissions. Roles are assigned to groups, not to individuals.
ProjectA group can be scoped to specific projects, limiting where its access applies. See Projects.
A member’s effective access is the combination of the roles on every group they belong to—permissions are additive. A member can be in multiple groups, and a group can hold multiple roles. Members never get permissions directly. Access always flows down this hierarchy—a member belongs to groups, groups are granted roles, and roles are bundles of permissions:
Roles are predefined. You assign existing roles to groups; you don’t create custom roles in the Console.

Roles

Nscale provides the following roles. Roles apply either across the whole organization or only within the projects a group is assigned to.
RoleScopeWhat it allows
AdministratorOrganizationFull control of the organization—manage members, groups, projects, and all resources.
AuditorOrganizationRead-only access to everything in the organization.
UserOrganization and projectRead access at the organization level, plus the ability to create and manage resources in the projects the group is assigned to.
ReaderProjectRead-only access within the projects the group is assigned to.
Assign the least-privileged role that lets a group do its job. Use Auditor or Reader for people who only need visibility, and reserve Administrator for those who manage the organization.

Who can manage groups and roles

Two rules decide whether you can create or edit a group. Both must be satisfied. 1. Being in a group doesn’t let you manage it. Membership gives you the group’s permissions; it does not give you control over the group. To create, edit, or change the members of a group you need a role that allows managing groups—typically Administrator. A User or Reader who belongs to a group still can’t add people to it. 2. You can only assign roles you already hold. To prevent anyone from granting access they don’t have themselves, you can only give a group a role whose permissions you fully hold. This is why the role picker only lists roles you’re allowed to assign—any role you couldn’t grant is hidden.

Why a group might not be editable

Rule 2 also applies to a group’s existing roles. Saving any change to a group re-checks every role already on it, so:
If a group includes a role you don’t have permission to grant, you can’t edit that group at all—not its name, not its roles, and not even its members—until someone who holds those roles makes the change.
This can be surprising: you might belong to a group and have an administrator role, yet still be unable to add a member, because the group also carries a more specialised role (for example, a role for a specific service) that your roles don’t include. In the Console the group’s edit and Update Members actions are disabled in this case, with a note explaining why. Deleting still works. You can delete such a group (if your role allows deleting groups), because deleting only removes access—it never grants a role—so it isn’t subject to this rule. What to do: ask an organization administrator who holds the missing role to make the change, or have someone with the broader role added so the group’s full set of roles can be granted. If you manage roles centrally, make sure your Administrator role includes every permission used by the more specialised roles you expect administrators to assign.

Manage members

Members are managed from Settings → People, in the Organization Members card. The table shows each member’s email, last active time, groups, and status:
StatusMeaning
PendingThe member has been invited but hasn’t joined yet
ActiveThe member has joined and can access the organization
SuspendedThe member’s access is currently revoked

Invite a member

1

Open the People tab

Go to Settings → People and find the Organization Members card.
2

Invite members

Click Invite Members, then enter one or more email addresses (separated by commas), and select the groups the new members should belong to.
3

Send the invite

Click Invite. Each invited member appears with a Pending status until they join, after which they become Active.

Remove a member

In the Organization Members table, use the member’s actions menu to remove them, then confirm. Removing a member permanently revokes their access to the organization.

Manage groups

Groups are managed from Settings → People, in the Organization Groups card. The table shows each group’s name, the projects it can access, its members, and its roles.

Create a group

1

Open the People tab

Go to Settings → People and find the Organization Groups card.
2

Create the group

Click Create Group, then set:
  • Group Name — can only contain lowercase alphanumeric characters and dashes.
  • Role — select one or more roles the group’s members will have.
  • Add members — add the members who should belong to the group.
3

Save the group

Click Create group. The group appears in the Organization Groups list.

Edit or delete a group

Select a group to open its detail page:
  • Group Details — rename the group or change its roles.
  • Group Members — use Add Members to add people to the group.
  • Delete Group — permanently delete the group. You’ll be asked to type the group’s name to confirm.
If the edit and Update Members actions are disabled, the group includes a role you’re not allowed to grant—see Why a group might not be editable.
Deleting a group is permanent. It removes the group’s access from every project it was assigned to.

Give a group access to projects

A group’s access is scoped to the projects it’s assigned to. You assign a group to a project from the project’s settings, not from the group itself. Once assigned, the group’s members gain that group’s project-scoped permissions within that project. See Projects for how to manage project membership.

Next steps