Users, roles, and access

Access to the Aptabit Platform follows the principle of least privilege: each person gets a role, the modules they need, and the workspaces they work in. Management happens in Settings > Users & access.

Roles

Role	What it can do
Root account	Owner of the installation, created at the first sign-in. It always signs in with e-mail and password, never takes part in SSO, and no group rule changes it. Only it can change its own password and e-mail.
Administrator	Reaches every module and Settings: users, workspaces, models, logs, governance, brand, license, and system. Creates and publishes agents.
Member	Uses only the modules granted, in the workspaces they belong to.

Per-person modules

The modules granted individually are Chat, Agents, Storage, Data, Flows, Schedules, and Integrations. New people start with no modules; the administrator grants each one explicitly.

Effective access combines role, modules, workspace membership, and the scope of each agent and each model.

Workspaces

Every person has a personal workspace.
Administrators create shared workspaces and define their members and enabled models.
Members can be added directly or through SSO group rules.
Before a workspace is deleted, the platform shows the impact of the deletion.

Passwords of at least 12 characters, stored with an Argon2 hash.
A temporary 15-minute lockout after repeated failures: 7 per source and 30 per account.
Sessions in HttpOnly, SameSite=Strict cookies, marked Secure when the platform is served over HTTPS.

Corporate SSO (OIDC)

The platform acts as an OIDC relying party, with Authorization Code and PKCE:

Provider	Directory groups
Microsoft Entra ID	Read through Microsoft Graph, including nested groups.
Google Workspace	Read through Cloud Identity.
Any OIDC provider (Keycloak, Okta, Auth0, and others)	Read from the configured claim, `groups` by default.

The connection test checks discovery, signing keys, the client secret, and callback URLs.

Group rules

Each rule maps a directory group to the administrator role, modules, and shared workspaces. The * rule applies to every account of the provider. What a rule grants is kept separately from what an administrator grants by hand, and effective access is the sum of both. Leaving a group in the directory takes effect at the person's next sign-in.

Mode	Effect
Password only	Local sign-in only.
Password and SSO	Both options on the sign-in page.
SSO only	The corporate provider only; the root account keeps its password.

Multi-factor authentication is enforced by the identity provider.

Planned: SAML, SCIM provisioning, and LDAP/Active Directory.

Root account recovery

If the root account loses its password or is locked, it is recovered on the server with a recovery key issued by Aptabit:

Shell

aptabit recover-root --key-file recovery-key.txt

The key works once, only for that installation, and is verified offline. Recovery sets the new password, ends the open sessions, clears the failed sign-ins, and records the key used in the audit trail. With --link, the command also creates a one-time access link, valid for ten minutes.

Brand and languages

In Settings > Brand, set your organization's logo, name, and color on the sign-in page and in the menu. The interface is available in nine languages, with light and dark themes.

Settings areas

Tab	What it controls
Users & access	Accounts, roles, modules, SSO, group rules, and sign-in mode.
Workspaces	Shared workspaces, members, and enabled models.
Models	Providers, local models, catalog, default models, and chat settings.
Logs	Unified log, usage per person, and OpenTelemetry export.
Governance	Indicators, irregularity register, retention, and data dictionary.
Brand	Logo, name, and color.
License	License status, replacement, and renewal.
System	CPU, memory, disks, GPUs, and local inference servers.