Roles

Users of Smartchat can have different Roles. Each Role comes with a different set of permissions throughout the system. For a quick-reference matrix of what each role can do, see Roles & Permissions.

Roles fall into three orthogonal dimensions:

• Chat Interface (OpenWebUI) — controls access and permissions to the chat frontend
• Application management — controls global Smartchat administration
• Space-level — controls access and rights within a specific space (a user can hold a different space-level role in each space)

Roles in different dimensions are independent — holding a role in one dimension does not automatically grant any rights in another. Within a dimension, some roles are supersets of others (noted in each section below).

Chat Interface (OpenWebUI)

These roles control access and permissions to the chat frontend.

User

The default Role anyone with access to Smartchat has. Users can access the Chat Interface (OpenWebUI) and My Space.

OpenWebUI-Admin

OpenWebUI-Admin is a superset of User. Admins can access the OpenWebUI Admin Panel, control which Chat and Feature Permissions users have, and see and access all Workspace Items. Admins have all permissions by default.

Application management

These global roles manage the Smartchat application itself. They are independent of each other — a user may hold either, both, or neither.

Application Owner

Top-level administrator of the Smartchat platform.

• Manages spaces (create, delete)
• Manages Space Owners and assigns them to spaces
• Views statistics across all spaces (number of users, files, etc.)
• Oversees application settings, global updates, and system monitoring

Data Scientist

Application-wide configuration manager.

• Manages Ingest and Retrieval configurations for the entire application (e.g. embedding models, pipeline settings)

Space-level

These roles are space-dependent — a user can hold different roles in different spaces. For example, a user can be a Space Owner in one space and a Space User in another.

Space User

Standard user within a space. If a user has this Role, they can access a Space and it becomes visible in the Space-Selector Dropdown.

• Sees workspace items they created, plus public items and items shared with their groups (see Sharing & Visibility)
• Some features are available in certain Spaces to users of that Space only

Space Owner

Administrator of a specific space. A space can have multiple Space Owners. Space Owner is a superset of Space User — they have all of a Space User’s capabilities, plus:

• Manages users within the space (add, remove, promote, demote)
• Manages space-specific configurations (Available LLMs, Ingest- and Retrieval Configurations, Space Confidentiality)
• Can elevate a Space User to Space Owner or demote other Space Owners
• Cannot demote themselves (at least one Space Owner must remain active per space)
• Sets up data connections and auto-sync (e.g. Confluence sync)
• Manages groups within the space (create, add/remove users, configure group permissions)

All files and roles within a space belong to the Space — they are not tied to the Space Owner who created them and continue to persist even when the Space Owner’s account is deleted.