Group user accounts into departments so one set of provider credentials and one policy override reaches everyone in the group.

A tenant group is a department. Put accounts into one group and they share its provider credentials, its security-filter overrides, and — where the LLM Risk Analyst is licensed — a group leader who can see their reviews.

What do I need?

Licence: Any
Role: admin_user

Prerequisites

At least one user account exists under Tenant Management.
You are signed in as an admin_user or the superadmin. A viewer is refused this page.

An admin_user may only manage the groups it owns — creating a group stamps the creator as its owner. The superadmin manages every group. Membership is bounded by the caller's own scope: you can add somebody you can already read, and growing a department beyond your own scope is a superadmin action.

Screenshot pendingTenant Groups listing group name, description, member count and creation date/assets/screenshots/tenant-groups@0.4.png

Create a group

Open the page

Select Administration → Tenant Groups.

The list shows each group with its member count and the summary line {total} groups · {memberships} memberships on this page.

Start a new group

Select Add group.

The Create New Group dialog opens.

Name the group

Enter a name in Group name and, optionally, a Description.

The name is limited to 100 characters and must be unique across the appliance; the description to 255.

Save

Select Create.

A Tenant group created successfully toast appears and the group joins the list with zero members.

Add and remove members

Open the membership dialog

Select the group's row, or select Open menu → Manage members.

Manage Group Members lists the current members under Current Members ({total}).

Add a member

Under Add New Member, pick an account from Select tenant, leave the role as Member, and select the add button.

The toast Member added to group successfully confirms it, the account appears in the member list stamped Added {date}, and the Groups column on Tenant Management updates.

Accounts that are already members are not offered in the picker; when none is left the picker shows No available tenants.

Remove a member

Select the remove button beside a member's name.

The toast Member removed from group successfully confirms it.

Note

The membership role dropdown offers Member and Admin. The gateway stores only member and leader on a membership row, and it is leader that grants the group-leader view on My team. The Admin label in this dialog does not correspond to a role the gateway acts on.

Give the group a shared provider credential

Group credentials are not created on this page. A credential belongs to exactly one owner — one account or one group — and the owner is chosen when the credential is created.

Open the credentials page

Select Administration → Credentials, then Add credential.

The Create New Credential dialog opens.

Assign it to the group

Set Assign To to Tenant Group (Shared) and pick the group under Tenant Group.

Every member of the group can then use that provider, and the models it serves appear in their model list. Full field detail is on Credentials.

Set a policy override for the group

Jump to the group's filters

Select Open menu → Security filters.

The Input filters page opens already scoped to this group, so the rules you change there apply to every member.

Delete a group

Empty the group first

Remove every member and move every credential the group owns to another owner.

A group with attachments cannot be deleted — see If it fails below.

Delete it

Select Open menu → Delete, then Delete in the confirmation.

A Tenant group deleted successfully toast confirms it.

Fields reference

Create New Group / Edit Group

Field	Required	Rule	What it does
Group name	Yes	Max 100 characters, unique	Names the department everywhere it appears
Description	No	Max 255 characters	Free note shown in the Description column

Manage Group Members

Control	What it does
Select tenant	Picks the account to add. Existing members are excluded
Role (Member / Admin)	Written to the membership row. Only `leader` is read by the product, for the group-leader view
Current Members (`{total}`)	The live membership list, each row stamped Added `{date}`
Synced from AD	Marks a membership that directory sync created, with the hint Managed by directory sync — manual changes may be overwritten.

List columns

Column	Shows
Group name	The group's name
Description	The free note, or an em dash
Members	The number of member accounts
Created	The date the group was created

Warning

The Filter groups… box narrows only the page you are looking at — the gateway's group list takes no name filter. Page through the list rather than trusting an empty result on page 1.

Directory-mapped groups

A directory sync scope can point at a tenant group, in which case sync enrols matching directory users into it. Those memberships carry the Synced from AD badge. They can be removed by hand, but the removal is not durable: the next sync, or the member's next login, re-enrols them. Manage the membership in the directory instead. Directory sync is configured under Settings.

Verify

The group appears with the member count you expect, and each member's Groups column on Tenant Management now lists the group.
Sign in as a member and open the chat. Models served by the group's credential are offered.
Group changes are not written to the audit trail in 0.4 — no RESOURCE_CREATED, RESOURCE_UPDATED or RESOURCE_DELETED row is produced for a group or a membership, so the list itself is the check. Account changes made from Tenant Management are audited.

If it fails

You can only manage tenant groups that you own — you are an admin_user acting on a group somebody else created. Ask its owner or the superadmin.
Tenant group with this name already exists — group names are unique across the appliance.
Group is not empty with the detail "{group}" still has {members} member(s) and {credentials} credential(s) attached. Remove the members and move the credentials to another owner, then delete the group. — this is the gateway's GROUP_NOT_EMPTY refusal. Nothing was deleted.
A delete refused with GROUP_MAPPED_BY_SYNC_SCOPE — a directory sync scope still targets this group. The message names the scopes; re-point them at another group, or clear the mapping, then delete.
Tenant is already a member of this group — the membership already exists.
Only administrators can manage tenant groups. — your role can reach the address but not the page. A viewer sees this here even though it can read Tenant Management.

Next steps

Credentials — create the shared provider key the group's members will use.
Input filters — set the detection policy the group overrides.
Access keys — issue a gateway key bound to the group, and read the identity caveat that comes with one.

Manage tenant groups