Organization & access control
Organization management lives in the admin console under Account: Organization (/admin/organization) and Access Control (/admin/rbac).
Organization page
Section titled “Organization page”The Organization page shows four KPIs at the top: Members, Pending invites, license Expires (or Perpetual license), and Seats remaining.
Members
Section titled “Members”The members table lists each Member with their Role and Joined date. Use Remove member to remove someone from the organization.
Groups
Section titled “Groups”Use Groups to create a group and assign organization members. Manual groups can be renamed, updated, deleted, and used in Access Control. Groups synchronized from SharePoint are read-only and apply only to synchronized document permissions because SharePoint owns their lifecycle and membership.
Deleting a manual group removes its ticket-role assignments and resource grants. A group never grants organization-admin access.
Inviting members
Section titled “Inviting members”- Open the Invite members sheet.
- Enter one or more email addresses. Emails that already belong to another organization are blocked.
- Choose the Default role applied to all invitees.
- Click Send invite.
Sent invitations appear in the Pending invites list until they are accepted. Each admin can create only one organization; the organization itself is set up during onboarding with a name and slug.
License
Section titled “License”The license card shows the license Status (Active, Expired, or Inactive), the Expires date, and the number of Seats (or Unlimited).
When the license expires, admin screens are blocked until the license is renewed.
nara ships with two built-in roles:
| Role | Purpose |
|---|---|
| Admin | Full access, including the admin console and access control |
| Member | Day-to-day use of chat, tickets, and assigned resources |
These organization roles control access to the admin console. Ticket and resource access are configured separately on Access Control.
Access Control
Section titled “Access Control”The Access Control page (/admin/rbac) governs which people and groups can use each resource.
Access modes
Section titled “Access modes”The resource families Assistants, Workflows, Skills, Tools, and Knowledge each have an access mode:
- Open — everyone in the organization can use resources of this family.
- Restricted — only people or groups with an explicit grant can use them.
You can also restrict a single resource, for example one assistant, while its family stays open. Admins always retain access regardless of the mode.
Ticket roles
Section titled “Ticket roles”Tickets use two dedicated roles:
| Ticket role | Capabilities |
|---|---|
| Supporter | View, update, assign, comment, delete closed tickets |
| Viewer | Read-only access |
Assign either ticket role to a person or a group. Group members receive the role while they remain in the group.
Scheduled tasks
Section titled “Scheduled tasks”The Scheduled tasks role lets people create, edit, resume, and run their own scheduled tasks. The Standard access profile includes it. To limit scheduled tasks, switch the role off in Standard and on in the access profile that keeps it. A task whose owner lost the role pauses before its next run; the owner can still pause and delete it.
Knowledge folders
Section titled “Knowledge folders”Access to Knowledge is granted by folder to People and Groups. Folder grants cascade to everything inside the folder.
Access check
Section titled “Access check”Use the Access check (Explain) tool to verify a configuration: pick a User, a Resource kind, and a resource ID. The tool returns Allowed or Denied together with the reasons — which mode, role, or grant produced the decision.
Single sign-on
Section titled “Single sign-on”Admins set up single sign-on at the end of the Organization page. Set up SSO walks through Verify domain, Choose provider, Configure provider, and Test and activate. Once SSO is active, users of the verified domains sign in through the provider.