Documentation
Roles and permissions
Understand the IntQuest permissions and personas, and configure least-privilege access.
Permissions
IntQuest grants capabilities through group permissions rather than fixed role names. A user has every permission of every active group they belong to. There are two permissions:
| Permission | What it unlocks |
|---|---|
| Modify Settings | Files, uploading with Import, and the Process, AI, Models, and Topics administration sections. |
| Users / Groups | The Users and Groups administration sections. |
A user with no group, or with groups that have no permissions, can use Stats, Search, Docs, File View, and Text Drilldown.
Personas and access boundaries
Use the following personas as least-privilege starting points and create groups that match your operating model.
| Persona | Permissions | Typical access |
|---|---|---|
| Analyst or reviewer | None | Stats, Search, File View review, and Text Drilldown |
| File operator | Modify Settings | Analyst access plus Files and Import. This permission also opens Process, AI, Models, and Topics. |
| ML operator | Modify Settings | Model training and activation, AI settings, and topics |
| Access administrator | Users / Groups | Users and groups only |
| Workspace administrator | Modify Settings and Users / Groups | All administration sections |
| Master administrator | Built-in Administrators group | All capabilities and recovery operations. Don’t share this account or use it for routine review work. |
Because Modify Settings covers Files, Import, and every platform section, you can’t grant file management without also granting access to processing, AI, model, and topic settings. Assign it only to people who are trusted with those settings.
Permission behavior
- Import is visible to every user, but uploads fail for accounts without Modify Settings.
- Administration appears in the navigation bar when the account has at least one of the two permissions. Inside it, only the allowed cards and sections appear.
- Deactivating a group removes its permissions from its members until you activate it again.
- A missing navigation item means that the signed-in account doesn’t have access. It isn’t an application error.
Recommended group setup
- Keep the built-in master administrator only for bootstrap and emergency recovery.
- Create groups for the personas you need, for example Analysts, Operators, and Access Administrators.
- Grant only the permissions that each persona needs.
- Test each group with a non-production account before assigning real users.
- Review group membership when responsibilities change.
Escalation and recovery
If a user can’t see a required section, an administrator with the Users / Groups permission should review the user’s group membership on the Groups page. Don’t share the master administrator password as a workaround. For master account recovery, follow Secure administrator bootstrap.