What this video covers
This video explains the two layers that determine access in UP, and shows how to build a Role and a Group in Settings → Roles / Groups.Good to know
Two layers of access — why?
Two layers of access — why?
UP separates platform-level access from content-level access:
- Organization Permissions (set up in Roles, assigned directly to a user in Users) control admin/platform-level access — things like who can manage billing or user management itself.
- Spaces and per-space roles (assigned via Groups) control what a user can actually do inside a given Space. There’s no per-space setting on the Users form — it always goes through a Group.
How do Roles work?
How do Roles work?
A Role sets a permission level — typically Manage, Edit, View, or No access — per application. Once created, a Role shows up as an option in the Organization Permissions field when you add or edit a user.
How do Groups work?
How do Groups work?
A Group bundles a set of users with a shared set of Space + role assignments, so you can grant a whole team access to the right Spaces at once instead of configuring each person individually. Every Space you add to a Group needs at least one role attached to it. One Group can be marked as the default — new users land in it automatically — and the default Group can’t be deleted.
Which one do I need for a new hire?
Which one do I need for a new hire?
Usually both: a Role if they need any admin/platform capability, and membership in a Group if they need to work inside specific Spaces.
Next step
With access under control, connect the storage your Spaces will use — continue to Adding Storages.Related documentation
User Management
Full reference for Roles, Groups, Spaces, and how they interact.