Access Groups
An Access Group is a named collection of users. Groups exist so that a project’s access exception can name a whole team at once instead of each person separately.
Access Groups are not roles. Adding a user to an Access Group does not change their permissions, their Access Level, or their Role. A group is purely a batch of users — it has no permission logic of its own. What each member can do inside a project is still determined by the project’s access default and any exception, and by their individual Role.
Access groups come with Pro. Below Pro, the Access groups tab and its Settings entry carry a lock and the plan name, and still open. A workspace that has never had groups sees what Pro adds, with Upgrade to Pro for a billing admin or, for anyone else, who can change the plan and an Ask button. After a downgrade, existing groups keep granting access: they are listed read-only under a banner, and only creating and editing them is locked. See Plans and Billing.
When to use Access Groups
Groups are useful when the same set of people needs the same treatment on several projects. Instead of adding one exception per person per project, you add them to a group once and then add that group as a single exception wherever it applies.
Example: a "Contractors" group might contain 8 external testers. One No access exception naming the group closes a project to all eight at once, and removing someone from the group restores their access without touching the project.
Managing groups
Access Groups are managed under Settings → Access groups. Only Tenant Admins can create, edit, or delete groups.
From that tab you can:
- Create a new group with a name and optional description
- Add or remove members from a group
- Enable or disable a group (disabling prevents it from being used without deleting it)
- Delete a group (the users themselves are untouched)
The New group and Edit group dialogs cover identity and membership only — name, description and members. A group’s enabled state, and deleting it, live in that row’s actions menu instead, so the state has one place to change.
Assigning a group during invitation
When inviting a new user, Tenant Admins can assign the user to one or more Access Groups at the same time. This is optional — groups can also be managed separately after the user has joined.
"What is the difference between an Access Group and a Role?" A Role defines what a user can do — their permission set inside projects. An Access Group defines who moves together — a batch of users you want one project exception to cover as a unit. They solve different problems and are completely independent. A user can be in multiple groups and still have only one Role.