Roles & Permissions

This page is a quick-reference matrix of what each role can do. For prose descriptions of each role, see Roles.

Permissions fall into two scopes:

• Global: apply across the whole application, independent of any Space.
• Space: scoped to a single Space. You hold a separate Space role in each Space you belong to, so you might be a Space Owner in one Space and a Space User in another.

Global permissions

Global roles are independent of one another and of your Space roles; a user may hold any combination.

Chat frontend (OpenWebUI)

Everyone with access to Smartchat is a User. OpenWebUI-Admin is granted in addition to those who manage the chat frontend.

Capability	User	OpenWebUI-Admin
Access the chat frontend (OpenWebUI)	✅	✅
Access the OpenWebUI Admin Panel	❌	✅
Configure feature/chat permissions per user (globally)	❌	✅
See and manage all workspace items and groups in any Space they belong to	❌	✅

Application management

Roles for managing the Smartchat application itself.

Capability	Application Owner	Data Scientist
Assign the global Data Scientist role	✅	❌
View statistics across all Spaces	✅	❌
Manage application settings	✅	❌
Manage global ingest & retrieval configuration (embedding models, pipelines)	❌	✅

Space permissions

Each user holds one Space role in each Space they belong to: Space User or Space Owner (all permissions of a Space User plus administrative ones). These capabilities are scoped to a single Space and affect Administration.

Space administration

The Application Owner column shows which of these a global Application Owner can perform in any Space. A dash (—) marks capabilities that are not tied to the Application Owner role itself; they depend on being a member of the Space.

Capability	Space User	Space Owner	Application Owner
Space appears in the Space Selector	✅	✅	—
Use features that are only available in this Space	✅	✅	—
Create or delete the Space	❌	❌	✅
Add or remove Space members	❌	✅	✅
Promote or demote Space Owners	❌	✅	✅
Manage Space configuration (LLMs, confidentiality, API key)	❌	✅	❌
Set up Confluence sync and S3 AutoSync	❌	✅	❌
Create, edit, and delete groups; add or remove their members; configure group permissions	❌	✅	❌

Workspace items (collections, assistants, prompts)

User-created items are private by default: visible only to their creator until shared. The one exception is the auto-provisioned “{Space} - General” collection, which everyone in the Space can access. See Sharing & Visibility for how visibility and sharing work.

Capability	Space User	Space Owner
Create private items	⚙️ Optional (admin setting)	✅
Create public items	⚙️ Optional (admin setting)	✅
Share their items with groups	✅ (only their groups)	✅ (any group)
View items they created, public items, and items shared with their groups	✅	✅
See and edit all items in the Space	❌	✅

Note

• A Space Owner’s ✅ capabilities apply within their own Space; an Application Owner’s apply to any Space.
• A Space Owner cannot demote themselves; at least one Space Owner must remain per Space.
• Global and Space roles are independent: a global role does not grant you a Space role. An Application Owner can create Spaces and manage any Space’s membership, but is not a Space Owner and does not manage a Space’s configuration or groups.
• Group management deliberately overlaps the two scopes: a global OpenWebUI-Admin can manage groups in any Space they belong to, while a Space Owner manages groups within their own Space regardless of OpenWebUI-Admin status.