Last updated: 2026-11-05 Product area: Onboarding Page type: Admin guide

Access and roles

Video walkthrough: workspace roles, permissions, AI model governance, and steward approvals.

Do this before extraction, search, or connector setup. The browser signs you in with an opaque session cookie named bundata_session. That cookie is not a Bundata API key, and it is not an OpenAI, Anthropic, or Google key.

Open the Bundata application URL your administrator gave you.
Sign in with the method on that account: email and password, Google for an existing linked account, or your organization’s SSO when that enrollment mode is enabled.
If the response says enrollment is closed (ENROLLMENT_CLOSED), public self-serve registration is not available. Ask the client administrator or Bundata. Do not create a second account to get around it.
If the password form says the account uses Google or SSO, use that method.

Choose the workspace

An account can belong to more than one workspace. The active workspace is stored on the browser session.

Open the workspace switcher and select the workspace named in your onboarding instructions.
Confirm the badge. A stored workspace keeps documents, schemas, runs, and results (workspaces created before explicit policy tags default to stored mode). A non-retaining workspace is a separate path and shows that it does not retain customer content.
If you cannot see the workspace, you are not a member. An owner or admin must grant membership. Switching workspaces does not copy data between them.

Platform notices and updates

The platform header includes a notifications bell and status banners for workspace problems, upload statuses, and new application builds (version.json). Error and warning notices stay visible until you dismiss them or open the linked screen.

Roles

The role hierarchy is owner, admin, editor, and viewer. A legacy member role is treated as editor.

Role	Typical use	AI providers and models in Settings
Owner	Organization and workspace control, assigning owners, and privacy retention settings (`learning:manage`, `ask_history:manage`, `explore:manage`)	Can connect or remove organization AI provider keys and change workspace model choices
Admin	Invite and manage members, manage agent credentials (`agent_credential:manage`), review graph queues (`graph:review`), and manage Context Engine (`context_engine:manage`)	Can connect or remove organization AI provider keys and change workspace model choices
Editor	Upload, extraction, schema work, runs, and context library drafts/proposals (`library:edit`)	Can see connected providers and the AI model map read-only; editors named as library stewards gain `library:approve`
Viewer	Read granted collections, answers, and approved context library entries (`library:read`)	Read-only view of model configuration; cannot change keys or models

Shared settings apply to the organization or workspace, not to one person’s private key. Replacing an organization provider key or changing a workspace model affects later model calls. It does not rewrite embeddings or extractions already stored.

Permissions you will meet

Documents and collections: Upload and source ingest require document:upload. Reading a collection requires collection:read and, for document content, document:read. Changing chunk sizes or running workflow knowledge layers requires collection:update.
Search, answers, and evaluation: Semantic search and grounded answers require agent:run. Starting evaluations requires eval:create.
Context Studio and Context Engine: Building layers or changing answer switches requires context_engine:manage (admin/owner). Editing library drafts or context sets requires library:edit; approving library versions requires library:approve (admins, owners, or named stewards). Deciding items in the Quality review console requires graph:review. Reading database schemas in the Data tab requires structured:manage and connection:use.
Privacy and memory: Managing Learning from questions requires learning:manage (owner). Managing Ask history and agent memory retention requires ask_history:manage (owner).

If an action is missing, the API returns 403 FORBIDDEN. Ask an owner or admin to change the role. Do not share your password or session cookie to “borrow” access.

Non-browser clients

Workspace admins can mint scoped bdk_… tokens in Settings → Agent access for /api/agent/v1/* and the workspace MCP server (see Developers). For general HTTP automation against /api/*, non-browser scripts authenticate via POST /auth/login bearer tokens. If a sign-in or a job fails, email contact@bundata.com.