{"schemaVersion":"1","contentVersion":"2026-10-18.1","slug":"controls-access","title":"Groups, invitations, and access controls","summary":"Understand who belongs to a group, which resources it can use, and when permission changes take effect.","category":"Control reference","minutes":10,"prerequisites":["Open the named screen in Rumata. Available controls may depend on your account, permissions, and resource state."],"sections":[{"id":"groups","title":"Groups and memberships","blocks":[{"type":"paragraph","text":"Open [System Explorer](/guides/controls-preview#navigation) → Permissions. A group is a set of people or workflows. Grant that group access from the specific resource’s [Manage access](/guides/controls-access#manage-access) menu."},{"type":"table","headers":["Control","What it does"],"rows":[["Groups / Invitations tabs","Switch between group membership management and invitations sent to you."],["Search groups","Find a group by its name."],["Collapse groups / expand groups","Change the amount of room used by the group list."],["Group row","Show its members and available invitation controls. Membership details may require belonging to the group."],["New","Open the group-creation form."],["Name / Description / Create group","Create a named group, optionally explaining its purpose. Creating it does not automatically grant access to all factory resources."],["Cancel / Close in New group","Dismiss the creation form without submitting."],["Invite by nickname / Invite","Send a membership invitation to the exact Rumata nickname of an existing account. New registrations may use their email as the nickname; confirm it with the recipient. Enter also submits. Private, single-user groups disable invitations."],["Add workflow / workflow search / workflow result","Choose a workflow to add as a member so it inherits the group’s access. Selecting the result applies the membership change."],["Copy workflow ID","Copy the identifier beside a workflow in the picker without adding it to the group."],["Remove from group / Leave group","Open confirmation to remove another member or yourself, where allowed."],["Remove in confirmation","Remove the membership and the access it grants. [Cancel](/guides/controls-access#groups) keeps it."]]}]},{"id":"invitations","title":"Invitations addressed to you","blocks":[{"type":"paragraph","text":"The same invitation actions are available from the account [Invitations](https://app.rumata.dev/invitations) page and the Permissions hub."},{"type":"table","headers":["Control","What it does"],"rows":[["Accept","Join the named group and receive the access granted to it."],["Decline","Reject the invitation without joining."],["Pending state","Temporarily disable both actions for an invitation while your response is being processed."]]}]},{"id":"manage-access","title":"Manage access for one resource","blocks":[{"type":"paragraph","text":"Open [Manage access](/guides/controls-access#manage-access) on a workflow, activity, database, bucket, or secret. Check the resource name at the top. Permission edits are staged until [Save changes](/guides/controls-access#manage-access)."},{"type":"table","headers":["Control","What it does"],"rows":[["Public row","Choose access for anyone on the internet, including people who are not signed in. Grant only the permissions intended for anonymous visitors."],["All Rumata users row","Choose access for every signed-in Rumata user, beyond your own team."],["Grant / permission count","Open that group’s permission choices and quick roles."],["Viewer / Editor / Admin","Replace the group’s draft selection with a quick role. Viewer allows reading; Editor also allows changes and deletion; Admin adds sharing and access management."],["Full access","Select every permission supported by this resource."],["Public API on a workflow","Select the permissions needed to run an HTTP workflow and receive its result. Applying this to the Public row opens that capability to anonymous callers."],["Individual permission checkbox","Add or remove just that capability from the draft. Available capabilities differ by resource type."],["Remove all access","Stage removal of that group’s permissions on this resource. It does not delete the group or its memberships."],["Add a group / Search groups / group result","Choose an existing group to stage for access. Assign its permissions, then save."],["Create a new group / name / description / Create & add","Create a group immediately and stage it in the resource’s access form. You still need to select [Save changes](/guides/controls-access#manage-access) to apply its permissions."],["Back in the group picker","Return from the new-group fields to the existing-group list."],["Save changes","Apply staged group attachments and permission edits. On failure, review the error and the remaining draft before retrying."],["Discard","Reset the permission draft to current server values."],["Done / Close","Dismiss access management. Closing does not apply an unsaved permission draft."],["Retry after an access-check error","Check your management permission again. If it was revoked, the dialog displays that you cannot manage this resource."]]}]},{"id":"permission-meaning","title":"Individual permission meanings","blocks":[{"type":"paragraph","text":"These are capabilities, not membership roles. A resource shows only the capabilities relevant to it."},{"type":"table","headers":["Control","What it does"],"rows":[["Read","View the resource and its available contents."],["Write","Create or modify the resource."],["Delete","Permanently remove the resource."],["Execute","Run a workflow, activity, or database operation where supported."],["Share","Share the resource with others."],["Clone / Deep clone","Copy the resource alone, or copy it together with nested resources."],["Deep read","Read the resource and resources nested under it."],["Manage access","Grant and remove group permissions on the resource."],["Build / Deploy / Undeploy","Build an activity, make its deployment available to workflows, or take that deployment down."]]}]}],"technical":[],"related":["collaboration","controls-secrets","controls-storage"],"sources":["components/window/explorer/access-control/AccessControlHub.tsx","components/window/explorer/access-control/GroupMembersPanel.tsx","components/window/explorer/access-control/ManageAccessDialog.tsx","components/window/explorer/access-control/GroupAccessRow.tsx","components/window/explorer/access-control/AddGroupControl.tsx","components/window/explorer/access-control/InvitationsPanel.tsx","lib/permissions.ts"],"updated":"2026-09-29","audience":"general","media":[{"src":"https://docs.rumata.dev/media/manual/new-group.jpg","width":1662,"height":789,"alt":"New group dialog with Name, Description, Cancel, and Create group.","caption":"Reference capture from the separate Sabai Talk Thai application (September 8, 2026). Enter a recognizable team name. Creating the group and granting it access to a resource are separate steps.","sectionId":"groups"},{"src":"https://docs.rumata.dev/media/manual/invitations.jpg","width":1000,"height":533,"alt":"Rumata Invitations screen with No pending invitations and Back to Home.","caption":"This account has no pending invitations. If someone invites you, their invitation and response actions appear here.","sectionId":"invitations"}],"video":null,"url":"https://docs.rumata.dev/guides/controls-access"}