Skip to main content

Configure RBAC

This guide configures role-based access control for your Qefro organization so the right people can administer vs chat.

Outcome​

  • Clear Owner / Admin / Member assignments
  • Teams that grant workspace access to Members
  • Employee AI portal showing only allowed workspaces

Role summary​

RoleTypical powers
OwnerFull control including billing-sensitive actions
AdminConfigure workspaces, knowledge, tools, members/teams
MemberUse Internal Portal for granted workspaces

Exact permissions can evolve — treat Admin Console as authoritative and keep Owners few.

Platform: RBAC, Teams, Organizations.

Step 1 — Assign Owners and Admins carefully​

  1. Keep a primary Owner account secured (unique email, strong password).
  2. Promote only trusted operators to Admin.
  3. Do not make every employee an Admin “for convenience.”

Step 2 — Invite Members​

  1. Invite employees with their work email.
  2. Complete verification / signup.
  3. Leave them as Members unless they must configure the product.

Step 3 — Create Teams​

Examples:

  • People Ops → HR workspace
  • IT Support → IT workspace
  • All Staff → company handbook workspace (if appropriate)

Step 4 — Attach workspaces to Teams​

  1. Open the Team.
  2. Grant access to the relevant workspace(s).
  3. Sign in as a Member and confirm the portal list matches grants.

Step 5 — Separate customer configuration​

Widget tokens and Support workspace tools are Admin concerns. Members should not need Admin to talk to Employee AI.

Workflow checklist​

RBAC hardening

  1. Minimize Owners/Admins — Break-glass Owner documented.
  2. Invite Members — Default least privilege.
  3. Create Teams by function — Not one mega-team if avoidable.
  4. Grant workspaces — Verify as a Member.
  5. Review quarterly — Remove leavers; rotate admins.

FAQ​

Can Members upload documents?
Document write rights are restricted; assume Admins manage knowledge unless your tenant explicitly enables broader flags.
How do contractors get temporary access?
Member + Team with only the needed workspace; remove the Team membership when the engagement ends.