> ## Documentation Index
> Fetch the complete documentation index at: https://ajuda.head.dataguvi.com.br/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage users, groups and permissions

> Add people, organize them into groups and set what each one can see and do in the platform.

This guide is for administrators. The simplest path is: add the person, put them in a [group](https://ajuda.head.dataguvi.com.br/en/glossary.md#user-group) and let the group set the [permissions](https://ajuda.head.dataguvi.com.br/en/glossary.md#permission). That way, when the team changes, you adjust the group once instead of person by person.

## Before you start

* You need the **Admin of Company** or **Admin of Conglomerate** [role](https://ajuda.head.dataguvi.com.br/en/glossary.md#role).
* Adding a user sends a first-access email. For that, the conglomerate's email server must be set up in **Administration › My Conglomerate**.
* Each company has a limit of active users, set in the contract.

What each administrator role can do:

| | Admin of Company | Admin of Conglomerate |
| - | - | - |
| Add **User** and **Admin of Company** | Yes | Yes |
| Add and edit **Admin of Conglomerate** | No | Yes |
| Create groups and set permissions | Yes | Yes, in all companies |
| Activate the modules of each company | No | Yes |
| Set up the email server | No | Yes |

## How access works

* **Administrators don't need permissions.** The Admin of Company already accesses everything in the company's [plan](https://ajuda.head.dataguvi.com.br/en/glossary.md#plan), and the Admin of Conglomerate accesses everything. That's why they don't appear in groups or in the per-person permissions tab.
* **People with the User role start with access to no module.** They only see what a group or an individual grant gives them.
* **One group is enough.** If the person is in several groups and at least one grants an action, they have that action.
* **An individual grant adds up.** It gives one person something beyond what their groups give, and it stays even if the group loses that access.
* **Nothing goes beyond the plan.** A module or action outside the company's plan can't be granted to anyone.

> [!NOTE]
>
> Permissions are loaded when the page opens. After any change, ask the person to reload the page.

## Add a user

**1. Open the user list**

In the side menu, click **Security & Governance › Users**, then **New User**.

**2. Fill in the details**

Enter **Full Name**, **Email** and **Phone**. The email is the person's login and can't be in use by another user.

**3. Choose the role**

In **Role / Position**, select **User**, **Admin of Company** or, if you're an Admin of Conglomerate, **Admin of Conglomerate**.

**4. Create the user**

Click **New User**. The platform creates the user and sends them the **Primeiro acesso** email, with a temporary password. See what they do with it in [First access](https://ajuda.head.dataguvi.com.br/en/getting-started/sign-in.md#first-access).

**5. Decide about permissions**

If the role is **User**, the screen asks whether you want to set up permissions now. For administrators, this step doesn't appear.

> [!NOTE]
>
> The platform's emails are sent in Portuguese for now, so the first-access email arrives with the subject **Primeiro acesso**.

If your company accesses the platform through its own portal, adding a user doesn't send an email: the person signs in directly through the portal.

### Configure now or later

* **Do it later** is the recommended path. Afterwards, add the person to a group (see [Create a group](#create-a-group)).
* **Configure now** opens the **Access Control** and **Dashboards** tabs. Turn on the modules and actions the person needs and click **Finish**.

> [!WARNING]
>
> What you select in **Configure now** becomes an individual grant: it applies only to this person and stays even if you change their group later. Use it for exceptions. For teams, use groups.

In the **Dashboards** tab, you choose which dashboards the person can view and edit and, when the dashboard uses [RLS](https://ajuda.head.dataguvi.com.br/en/glossary.md#rls-data-access-rules), which data rule applies to them. First, turn on the **Dashboards** module in the **Access Control** tab. To allow editing a dashboard, the **Edit** action must also be active in the module.

If you close the window with permissions selected but not saved, the screen asks “Leave without saving permissions?”. The user has already been created: only the selected permissions are lost.

## Edit, deactivate and reactivate

In the **Users** list, each row has three icons: view details (including last access), **Edit** and **Deactivate** or **Reactivate**.

* **Edit** changes name, email, phone, role and the **Active** status. If you change the email, let the person know: their login changes too.
* **Deactivate** removes the person's access to the platform. Permissions, groups and history are kept, and **Reactivate** restores everything as it was.
* **Users can't be deleted.** To remove someone's access, deactivate them.

The list shows only active users. To see inactive ones, change the filter to **Inactive users only** or **All users**.

> [!NOTE]
>
> Inactive users don't count toward the company's limit. If the limit is full, deactivate people who no longer use the platform before adding or reactivating someone.

## Create a group

**1. Open Access Control**

In the side menu, click **Security & Governance › Access Control** and choose the **Groups** tab.

**2. Create the group**

Click **Create new group**. Enter the **Group Name**, for example “Sales Team”, and, if you want, a **Description**.

**3. Choose the members**

Select at least one person in **Members** and click **Create Group**.

**4. Set the permissions**

With the group selected, adjust the modules in **Group Permissions**. See how in [Set permissions](#set-permissions).

To add or remove people later, use **Manage Members**. **Link Member** adds a person, and the **Remove from group** icon removes them. Only users with the **User** role appear.

> [!WARNING]
>
> When you delete a group, its members immediately lose all the permissions that came from it. Deletion can't be undone.

## Set permissions

Each module appears as a card. Changes are saved as soon as you click, with no save button: the card shows **Saved** for a moment.

* **Module Access** turns the whole module on and off. When you turn it on, the person or group can view the module. Then select the other actions: create, edit, delete, export, upload files and present.
* **View is required** while any other action is selected. To remove all access, turn off **Module Access**.
* The card's footer summarizes the access: **No access**, **View only** or **Full access**.
* **Module Locked** means the module isn't in the company's plan. **Restricted Action** means the plan has the module, but not that action.

### Change several modules at once

The buttons above the cards change all modules at once, after asking for confirmation:

| Button | What it does |
| - | - |
| **Enable all** | Grants view on modules that have no access. Doesn't touch the others. |
| **Read only** | Leaves only view on every module, removing the other actions. |
| **Full access** | Grants every action the plan allows on every module. |
| **Disable all** | Removes all access from every module. |

> [!TIP]
>
> The buttons only apply to the modules on screen. To apply them to some modules, filter first in **Search module by name...**.

## Grant something to one person only

Use this when a person needs something their group doesn't have.

**1. Find the person**

In **Access Control**, choose the **Users** tab and search for the person by name or email.

**2. Check what they already have**

The cards show everything the person can do right now, adding up their groups and individual grants.

**3. Grant what's missing**

Turn on the module or select the action. When you turn on a module, the screen shows **Who already has access** to it. Click **Grant access** to confirm.

> [!WARNING]
>
> Unselecting here only removes what was granted to the person individually. If the access comes from a group, it stays, and the action appears selected again when you reload the page. To remove that access, take the person out of the group or change the group's permissions.

## Activate the modules of each company

Only for the Admin of Conglomerate. This is where you distribute the contracted modules among the companies of the conglomerate.

1. In **Access Control**, choose the **Companies** tab and select the company.
2. Turn modules and actions on or off, as in [Set permissions](#set-permissions).

What's active here makes up the company's plan. What's off appears as **Module Locked** to the company's administrators.

> [!WARNING]
>
> Activate only what was contracted. When you turn off a module, everyone in the company immediately loses access to it, including the Admin of Company.

Selecting a company in the **Companies** tab also changes the groups and people shown in the **Groups** and **Users** tabs. On the **Users** screen, the list follows the company chosen in the company selector of the side menu.

## Dashboards and agents

Besides the module permission, each dashboard and each [agent](https://ajuda.head.dataguvi.com.br/en/glossary.md#agent) has its own list of who can use it:

* **Dashboards**: in **Administration › Reports & Dashboards**, choose who views and who edits each dashboard and, if it uses RLS, which data rule applies to each person.
* **Agents**: in **Administration › Agents**, choose who can use each agent in Datatalk AI.

## Common problems

> [accordion] “Action Blocked” when clicking New User
>
> The conglomerate's email server isn't set up, and without it the platform can't send the first-access email. The Admin of Conglomerate sets it up in **Administration › My Conglomerate**. The Admin of Company doesn't have access to that screen: ask the Admin of Conglomerate.

> [accordion] “You must configure an SMTP server…” after creating the user
>
> The email server failed to send the first-access email, but the user may have been created anyway. Reload the list before trying again. If the user is there, ask the Admin of Conglomerate to review the email server. Then the person can use **Forgot your password?** on the sign-in screen to receive a new password.

> [accordion] “Your company has reached the allowed user limit.”
>
> The company reached its limit of active users. Deactivate people who no longer use the platform or talk to whoever manages the contract to increase the limit.

> [accordion] “This email is already in use. Please choose another one.”
>
> A user with that email already exists. They may be inactive: change the filter to **All users** and, if that's the case, reactivate them. They may also be in another company.

> [accordion] The person didn't receive the first-access email
>
> Ask them to look for the **Primeiro acesso** email in their spam folder. If it's not there, they can use **Forgot your password?** on the sign-in screen to receive a new temporary password.

> [accordion] I unselected a permission in the Users tab and it came back
>
> The access comes from one of the person's groups. The **Users** tab of **Access Control** only removes what was granted individually. Take the person out of the group or change the group's permissions.

> [accordion] I can't find the person to add to a group
>
> Groups and the **Users** tab of **Access Control** only show people with the **User** role. Administrators already access everything in the plan and don't need a group.

> [accordion] The edit icon is disabled: “You don't have permission to edit this user.”
>
> The Admin of Company can't edit users with the Admin of Conglomerate role. Ask an Admin of Conglomerate.

> [accordion] I granted access, but the person still can't see it
>
> * Ask them to reload the page with `F5` (on a Mac, `Cmd` + `R`).
> * Check that they're in the right company, in the selector of the side menu.
> * If it's a dashboard or an agent, also check the access on the item itself (see [Dashboards and agents](#dashboards-and-agents)).
> * See other cases in [I can't see a menu, button or dashboard](https://ajuda.head.dataguvi.com.br/en/access/missing-menu-or-button.md).

> [accordion] “Could not save # Access Control permissions.” when finishing the setup
>
> Some permissions weren't saved. The ones already saved remain valid. Click **Finish** again to retry.

## Who can help

* **The Admin of Conglomerate** sets up the email server, adds other Admins of Conglomerate and activates the modules of each company.
* **Whoever manages your company's contract** increases the user limit and adds modules that haven't been contracted yet.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.