---
title: "Accounts and permissions"
description: "Give each person an account and the tenant permissions their work requires. Reading job content is a separate permission."
canonical_url: "https://docs.oz0.ai/getting-started/web-ui/accounts"
---
# Accounts and permissions

> Give each person an account and the tenant permissions their work requires. Reading job content is a separate permission.

For: People using the web UI.

Give each person an account and the tenant permissions their work requires. Reading job content is a separate permission.

## Accounts and roles

```bash [Terminal]
oz0 user add kim --role member         # prints a generated password, once
oz0 user grant kim --role operator     # kim's role in the default tenant
oz0 user grant kim --role reader --tenant acme --content
oz0 user add sam --role admin --password-stdin < password.txt
oz0 user list
oz0 user revoke kim --tenant acme
oz0 user password kim                  # a new password; signs kim out everywhere
oz0 user remove kim
```

An account has a role in each tenant it is a member of. Each role can do what the ones before it can:

<table>
<thead>
  <tr>
    <th>
      Role
    </th>
    
    <th>
      May
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        reader
      </strong>
    </td>
    
    <td>
      Look: nodes, agents, plugins, jobs and their steps, queues, errors, insights, cost, findings; export a job's shape
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        operator
      </strong>
    </td>
    
    <td>
      Also start, cancel and tag jobs, and decide approvals
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        admin
      </strong>
    </td>
    
    <td>
      Also change the tenant: nodes and rollouts, plugins, secrets, join tokens, the budget; and read its audit log
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        owner
      </strong>
    </td>
    
    <td>
      Also decide who is a member, under <em>
        Access
      </em>
      
      , <em>
        People
      </em>
      
      , or with <code>
        user grant
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        auditor
      </strong>
    </td>
    
    <td>
      Look, and read the audit log, evidence, retention and governance; change nothing
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        privacy-officer
      </strong>
    </td>
    
    <td>
      Look, and find and erase data subjects and place legal holds; start no job
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        agent-user
      </strong>
    </td>
    
    <td>
      Use the agents its membership grants in the chat drawer, and see only its own chats and jobs
    </td>
  </tr>
</tbody>
</table>

Each role is a set of permissions, and a membership may hold several roles; a server can add a role set's roles to these. *Access*, *Roles* lists the roles in force with their permissions, read-only; the role pickers under *Access* offer them. The web UI shows what the account's permissions allow (from `/api/auth/me`) and the API decides. An agent user lands in its chats and sees nothing else of the tenant. See [Roles and permissions](https://docs.oz0.ai/admin/tenants#roles-and-permissions).

Seeing what jobs read and wrote, such as prompts, answers, tool arguments and results, and each step's input and output, is a permission of its own. Operators, admins and owners have it unless an owner takes it away (`--content=false`), and readers do not unless an owner gives it (`--content`). Without it, the job page shows the shape of each job: which tools it called and when, its steps and their cost, but not their content.

The account itself has a cluster role: **admin** (the owner of every tenant, who also adds tenants and accounts), **reader** (reads every tenant) or **member** (only its tenants). `server init` and dev mode create one admin. Everyone with a password can change it under *Settings*.

- Sessions last seven days and end when the password changes. *Access* and `oz0 user sessions` list them; see [Sign-in](https://docs.oz0.ai/admin/sign-in/sessions#sessions). Five wrong passwords for one name from one address within 15 minutes cost a minute's wait.
- The session cookie only works for requests from the app itself: other sites cannot use it, and the app loads nothing from anywhere else, so it works without internet access.
- The CLI keeps using its operator certificate; accounts are for people in a browser.

For lists across tenants, use [All tenants](https://docs.oz0.ai/getting-started/web-ui/tenants#all-tenants).

[Back to Web UI](https://docs.oz0.ai/getting-started/web-ui).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.