Skip to content

Commit fc852b0

Browse files
Paul-CornellPaul-Cornell
authored
Multi-user/organizational accounts docs (#549)
1 parent 1b160fe commit fc852b0

File tree

5 files changed

+603
-2
lines changed

5 files changed

+603
-2
lines changed

‎style.css‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
.yes-label {
2+
background-color: green;
3+
color: white;
4+
padding: 4px 8px;
5+
border-radius: 4px;
6+
display: inline-block;
7+
}
8+
9+
.no-label {
10+
background-color: red;
11+
color: white;
12+
padding: 4px 8px;
13+
border-radius: 4px;
14+
display: inline-block;
15+
}

‎ui/account/api-key-url.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,11 @@ However, you might want the option to re-enable it after you solve your issues o
5959

6060
## Permanently delete an existing API key
6161

62-
<Caution>
62+
<Warning>
6363
Deleting an existing API key is a permanent operation. Deleted API keys cannot be recovered.
6464

6565
You cannot use a deleted API key to call the Unstructured APIs.
66-
</Caution>
66+
</Warning>
6767

6868
You might want to permanently delete an existing API key that you know is causing issues or is compromised.
6969

‎ui/account/organizations.mdx‎

Lines changed: 230 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,230 @@
1+
---
2+
title: Organizational accounts
3+
---
4+
5+
An _organizational account_ is an Unstructured account that allows multiple users to access Unstructured resources and share billing.
6+
An organizational account contains a collection of Unstructured [workspaces](/ui/account/workspaces) that can share resources
7+
with subsets of users within the account. An organizational account manages access its organization and the organization's workspaces by inviting Unstructured
8+
_personal account_ users. Any usage that occurs in an organizational account by any of its invited users is applied to the shared billing for that
9+
organizational account.
10+
11+
A _workspace_ is a collection of Unstructured resources (such as connectors, workflows, jobs, and API keys) within an organization.
12+
This is different from a _personal workspace_, which is a collection of resources within an Unstructured personal account. An organizational account
13+
can have multiple workspaces.
14+
15+
## Organizational account architecture
16+
17+
Each organizational account operates independently of all other organizational accounts.
18+
19+
Each organizational account can have multiple workspaces. Each workspace operates independently of all other workspaces.
20+
21+
```mermaid
22+
graph LR
23+
Org1[Organization 1]
24+
Org2[Organization 2]
25+
Org3[Organization 3]
26+
WS1A[Workspace 1A]
27+
WS2A[Workspace 2A]
28+
WS2B[Workspace 2B]
29+
WS3A[Workspace 3A]
30+
WS3B[Workspace 3B]
31+
WS3C[Workspace 3C]
32+
33+
Org1 --> WS1A
34+
35+
Org2 --> WS2A
36+
Org2 --> WS2B
37+
38+
Org3 --> WS3A
39+
Org3 --> WS3B
40+
Org3 --> WS3C
41+
```
42+
43+
Each organizational account can have multiple users. Users can have access to multiple organizational accounts.
44+
45+
```mermaid
46+
graph LR
47+
User1[User 1]
48+
User2[User 2]
49+
User3[User 3]
50+
Org1[Organization 1]
51+
Org2[Organization 2]
52+
Org3[Organization 3]
53+
54+
User1 -.-> Org1
55+
User2 -.-> Org1
56+
User2 -.-> Org2
57+
User3 -.-> Org1
58+
User3 -.-> Org2
59+
User3 -.-> Org3
60+
```
61+
62+
Each user also has a _personal account_, which operates independently of all other organizational accounts and personal accounts. Each personal account has a
63+
_personal workspace_, which operates independently of all other workspaces. Each user can add a seprate billing method to their personal account that
64+
will be applied only to usage in their personal account.
65+
66+
```mermaid
67+
graph LR
68+
User1[User 1]
69+
User2[User 2]
70+
User3[User 3]
71+
PA1[Personal Account for User 1]
72+
PA2[Personal Account for User 2]
73+
PA3[Personal Account for User 3]
74+
Org1[Organization 1]
75+
Org2[Organization 2]
76+
Org3[Organization 3]
77+
78+
User1 --> PA1
79+
User2 --> PA2
80+
User3 --> PA3
81+
User1 -.-> Org1
82+
User2 -.-> Org1
83+
User2 -.-> Org2
84+
User3 -.-> Org1
85+
User3 -.-> Org2
86+
User3 -.-> Org3
87+
```
88+
89+
Within an organizational account, an invited user (also known as a _member_) can have access to multiple workspaces within that organizational account.
90+
91+
```mermaid
92+
graph LR
93+
User1[User 1]
94+
User2_Org1[User 2]
95+
User2_Org2[User 2]
96+
User3_Org1[User 3]
97+
User3_Org2[User 3]
98+
User3_Org3[User 3]
99+
100+
Org1[Organization 1]
101+
Org2[Organization 2]
102+
Org3[Organization 3]
103+
104+
WS1A[Workspace 1A]
105+
WS2A[Workspace 2A]
106+
WS2B[Workspace 2B]
107+
WS3A[Workspace 3A]
108+
WS3B[Workspace 3B]
109+
WS3C[Workspace 3C]
110+
111+
Org1 --> WS1A
112+
Org1 -.-> User1
113+
Org1 -.-> User2_Org1
114+
Org1 -.-> User3_Org1
115+
User1 -.-> WS1A
116+
User2_Org1 -.-> WS1A
117+
User3_Org1 -.-> WS1A
118+
119+
Org2 --> WS2A
120+
Org2 --> WS2B
121+
Org2 -.-> User2_Org2
122+
Org2 -.-> User3_Org2
123+
User2_Org2 -.-> WS2A
124+
User2_Org2 -.-> WS2B
125+
User3_Org2 -.-> WS2B
126+
127+
Org3 --> WS3A
128+
Org3 --> WS3B
129+
Org3 --> WS3C
130+
Org3 -.-> User3_Org3
131+
User3_Org3 -.-> WS3A
132+
User3_Org3 -.-> WS3B
133+
User3_Org3 -.-> WS3C
134+
```
135+
136+
Each user must be explicitly added to the organizational accounts&mdash;and workspaces within those organizational accounts&mdash;that they are allowed to access.
137+
138+
## Create an organizational account
139+
140+
Only authorized Unstructured representatives can create organizational accounts. To request an organizational account to be created, contact your Unstructured
141+
sales representative, email Unstructured Sales at [[email protected]](mailto:[email protected]), or complete the online
142+
[Unstructured contact form](https://unstructured.io/contact).
143+
144+
## Access an organizational account
145+
146+
1. Depending on the location of the organizational account that you want to access, sign in to [https://platform.unstructured.io](https://platform.unstructured.io),
147+
or sign in by using the URL for your organization's [self-hosted deployment of Unstructured](/self-hosted/overview).
148+
2. In the top navigation bar, in the organizational account selector, select the name of the organizational account that you want to access.
149+
150+
If the organizational account selector is not shown, or if the selector does not show the organizational account you want to access, then
151+
your user has not been added to that organizational account. To be added to the organizational account, contact one of the organizational account's administrators.
152+
153+
## Add a member to an organizational account
154+
155+
<Info>
156+
Your user must have the **Super Admin** [role](/ui/account/roles) in the organizational account to add members to that organizational account.
157+
</Info>
158+
159+
To add a user to an organizational account as a member:
160+
161+
1. Depending on the location of the organizational account that you want to access, sign in to [https://platform.unstructured.io](https://platform.unstructured.io),
162+
or sign in by using the URL for your organization's self-hosted deployment of Unstructured.
163+
2. In the top navigation bar, in the organizational account selector, select the name of the organizational account that you want to add the member to.
164+
3. In the sidebar, above your user icon, click the **Settings** (gear) icon.
165+
4. Click **Manage Account**.
166+
5. In the top navigation bar, click **Members**.
167+
6. Click **New Member**.
168+
7. In the **Add New Member** dialog, enter the email address for the organizational account's new member.
169+
8. In the role selector, select the new member's [role](/ui/account/roles) for this organizational account.
170+
9. Click **Continue**.
171+
172+
## Change an organizational account role for a member
173+
174+
<Info>
175+
Your user must have the **Super Admin** role in the organizational account to change its members' organizational account roles.
176+
</Info>
177+
178+
1. Depending on the location of the organizational account that you want to access, sign in to [https://platform.unstructured.io](https://platform.unstructured.io),
179+
or sign in by using the URL for your organization's self-hosted deployment of Unstructured.
180+
2. In the top navigation bar, in the organizational account selector, select the name of the organizational account that contains the member you want to change roles for.
181+
3. In the sidebar, above your user icon, click the **Settings** (gear) icon.
182+
4. Click **Manage Account**.
183+
5. In the top navigation bar, click **Members**.
184+
6. Click the member you want to change roles for.
185+
7. Next to **Role** click the **Edit** (pencil) icon.
186+
8. Select the new role.
187+
9. Click the **Accept** (check mark) icon.
188+
189+
## Remove a member from an organizational account
190+
191+
<Warning>
192+
Removing a member from an organizational account also removes the member from all of the organizational account's workspaces. The member will no longer
193+
have access to the organizational account or any of its workspaces. The member will continue to be able to use their personal account and personal workspace.
194+
195+
Any connectors, workflows, jobs, or other resources that were created by the member within the organizational accounts's workspaces will not be removed.
196+
197+
The only way to reverse removing a member from an organizational account is to add the member back to the organizational account&mdash;and to each of the workspaces that the member might have previously
198+
been a member of in that organizational account.
199+
</Warning>
200+
201+
<Info>
202+
Your user must have the **Super Admin** [role](/ui/account/roles) in the organizational account to remove members from that organizational account.
203+
</Info>
204+
205+
1. Depending on the location of the organizational account that you want to access, sign in to [https://platform.unstructured.io](https://platform.unstructured.io),
206+
or sign in by using the URL for your organization's self-hosted deployment of Unstructured.
207+
2. In the top navigation bar, in the organizational account selector, select the name of the organizational account that you want to remove the member from.
208+
3. In the sidebar, above your user icon, click the **Settings** (gear) icon.
209+
4. Click **Manage Account**.
210+
5. In the top navigation bar, click **Members**.
211+
6. In the list of members, click the member you want to remove.
212+
7. In the member's settings pane, click **Remove Member**.
213+
8. Confirm the removal by clicking **Continue**.
214+
215+
## Permanently delete an organizational account
216+
217+
<Warning>
218+
Deleting an organizational account is a permanent action and is not recoverable. Once an organizational account is deleted, all workspaces associated with that
219+
organizational account are also deleted and are not recoverable.
220+
221+
The organizational account's members will no longer have access to the deleted organizational account or any of its workspaces.
222+
Each member will continue to be able to use their personal account and personal workspace.
223+
224+
Any code or scripts that reference connectors, workflows, jobs, or workflow API keys that are associated with workflows in the deleted
225+
organizational account will fail.
226+
</Warning>
227+
228+
Only authorized Unstructured representatives can delete organizational accounts. To request an organizational account to be permanently deleted, contact your Unstructured
229+
sales representative, email Unstructured Sales at [[email protected]](mailto:[email protected]), or complete the online
230+
[Unstructured contact form](https://unstructured.io/contact).

‎ui/account/roles.mdx‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
title: Role-based access control (RBAC)
3+
sidebarTitle: Roles
4+
---
5+
6+
_Roles_ in Unstructured are part of the _role-based access control_ (RBAC) system that manages permissions for members of
7+
organizational accounts and their workspaces. (Roles are not used in personal accounts.)
8+
9+
Any member with the **Super Admin** role in an organizational account can manage the roles of that organizational account's members and the roles of the
10+
members of the organizational account's workspaces.
11+
12+
Any member with the **Super Admin** role in an organizational account or the **Workspace Admin** role in a workspace within an
13+
organizational account can mange the roles of that workspace's members.
14+
15+
A **Super Admin** member assigns an organizational account member's initial role when they are [added to the organizational account](/ui/account/organizations#add-a-member-to-an-organizational-account). This member's
16+
initial role can be [changed](/ui/account/organizations#change-an-organizational-account-role-for-a-member) later.
17+
18+
A **Super Admin** or **Workspace Admin** member assigns a workspace member's initial role when they are [added to the workspace](/ui/account/workspaces#add-a-member-to-a-workspace). This
19+
member's initial role can be [changed](/ui/account/workspaces#change-a-workspace-role-for-a-member) later.
20+
21+
## Organizational account roles
22+
23+
Organizational account roles include:
24+
25+
- Super Administrator
26+
- Account Member
27+
- Billing Administrator
28+
29+
These roles include the following permissions:
30+
31+
| Permission | Super Administrator | Account Member | Billing Administrator |
32+
|---|---|---|---|
33+
| Organizational account management | | | |
34+
| Can add members to the account | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="no-label">No</span> |
35+
| Can remove members from the account | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="no-label">No</span> |
36+
| Can view members of the account | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="no-label">No</span> |
37+
| Can view an account member's details | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="no-label">No</span> |
38+
| Can change an account member's role | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="no-label">No</span> |
39+
| Billing | | | |
40+
| Can view usage and costs | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
41+
| Can edit payment information | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
42+
| Can add budget | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
43+
| Can distribute budget across workspaces | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
44+
| Workspaces | | | |
45+
| Can create workspaces | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="no-label">No</span> |
46+
| Can add members to a workspace | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="no-label">No</span> |
47+
| Can view members of a workspace | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="no-label">No</span> |
48+
| Can be added to a workspace | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> |
49+
| Can take actions in a workspace (based on their workspace role) | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="no-label">No</span> |
50+
51+
## Workspace roles
52+
53+
Workspace roles include:
54+
55+
- Viewer
56+
- Developer
57+
- Operator
58+
- Workspace administrators
59+
60+
These roles include the following permissions:
61+
62+
| Resource | Action | Viewer | Developer | Operator | Workspace Administrator |
63+
|---|---|---|---|---|---|
64+
| Workflows | Read | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> |
65+
| | Create | <span class="no-label">No</span> | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
66+
| | Edit | <span class="no-label">No</span> | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
67+
| | Delete | <span class="no-label">No</span> | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
68+
| | Run | <span class="no-label">No</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> |
69+
| | Schedule | <span class="no-label">No</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> |
70+
| Connectors | Read | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> |
71+
| | Create | <span class="no-label">No</span> | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
72+
| | Edit | <span class="no-label">No</span> | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
73+
| | Delete | <span class="no-label">No</span> | <span class="yes-label">Yes</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
74+
| Workspace members | Add members to the workspace | <span class="no-label">No</span> | <span class="no-label">No</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
75+
| | View the workspace's members | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> |
76+
| | Remove members from the workspace | <span class="no-label">No</span> | <span class="no-label">No</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
77+
| | Change the workspace members' roles | <span class="no-label">No</span> | <span class="no-label">No</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
78+
| Budget limits | Add budget | <span class="no-label">No</span> | <span class="no-label">No</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
79+
| | Edit budget | <span class="no-label">No</span> | <span class="no-label">No</span> | <span class="no-label">No</span> | <span class="yes-label">Yes</span> |
80+
| | View budget | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> | <span class="yes-label">Yes</span> |
81+
82+
Super Administrators in an organizational account have complete access to all of the organizational account's workspaces, regardless of whether they
83+
are a member of those workspaces.

0 commit comments

Comments
 (0)