The access model
Access in Nobly Insight is controlled in layers, each answering a different question. Together they decide who can run the platform, who can work with which documents, and who can see individual sensitive records.A quick rule of thumb: application permissions grant feature and administration capabilities; document access rights control content operations for people and integrations; security keywords narrow access to individual records on top of both.
Trace an access decision
For example, managing system searches allows you to edit a shared query. It does not let you read every document the query describes. Test both configuration access and content access when handing a search to another group.Permissions are granted to user groups
Application permissions are always granted to user groups, never to individuals directly. A user’s effective permissions are the combination of everything granted to every group they belong to. To give one person a capability, add them to a group that has it — or grant the capability to a group they’re already in. This keeps access manageable: you reason about a handful of groups instead of every individual user, and you can verify access through the user’s effective permissions. Existing sessions or tokens may need refreshing after membership changes.Permission tiers
Most permission areas come in tiers that build on each other:
Because the tiers are cumulative, you grant one tier per group for an area — granting Manage automatically gives that group View, and Admin gives both. Check the catalogue for each area: some operations, such as removing script bindings or managing user groups, are available at Manage. Do not assume every delete operation requires Admin.
Where to read next
Application permissions
A guide to Nobly Insight application permissions, grouped by area, and what each tier grants.
Managing permissions
Grant and revoke permissions for user groups on the Permissions screen.
Single sign-on & federation
Sign in with your own identity provider over OpenID Connect, and drive Insight group membership from your directory.