User and Group Management

Arbitex organizes access control around groups. Groups carry policy assignments, DLP configurations, and model access rules. Users belong to one or more groups, and their effective permissions are the union of all group-level settings. All user and group operations are available under Admin → Users and Admin → Groups.

Prerequisites

• Org Admin role

---

User Management

Search for a user

The user management panel includes a search autocomplete that queries the admin users API. Type part of a name or email address to filter the user list. Select a user to view their profile, group memberships, and recent activity.

Invite a user

Users who have not yet signed up can be invited by email:

1. Navigate to Admin → Users.
2. Click Invite User.
3. Enter the user’s email address and click Send Invite.

Arbitex sends an invitation email with a signup link. The invite is valid for 7 days. After expiry, the user must be re-invited.

Manage pending invites

The Pending Invites list shows all outstanding invitations with:

• Recipient email address
• Date the invite was sent
• Expiry date
• Token prefix (for support reference)

To cancel a pending invite before it is accepted, click Cancel on the invite row.

API reference

# Send an invitation
POST /api/v1/admin/users/invite
{ "email": "[email protected]" }

# List pending invites
GET /api/v1/admin/users/invites

# Cancel a pending invite
DELETE /api/v1/admin/users/invites/{invite_id}

---

Group Management

Groups are the primary unit of access control in Arbitex. The Group Management panel uses a three-panel layout:

• Left — group list with member count and IdP-link indicator
• Center — group detail (members, DLP overrides, compliance bundles, model access)
• Right — create or edit form (shown when adding or editing a group)

Create a group

1. Navigate to Admin → Groups.
2. Click New Group.
3. Fill in the fields:

Field	Required	Description
Name	Yes	Display name for the group (e.g., “Engineering”, “Legal”)
Description	No	Free-text description of the group’s purpose
External Group ID	No	Links this group to an IdP-managed group. When set, SCIM provisioning controls membership and a SCIM — IdP-managed group badge is shown in the group detail. See SCIM-managed groups.

4. Click Save.

Edit a group

Select a group from the list and click Edit in the detail panel to open the edit form. You can update the name, description, and External Group ID at any time.

Delete a group

Select a group, open the edit form, and click Delete. Confirm the deletion prompt. Deleting a group removes all policy and DLP assignments associated with it but does not affect user accounts.

Caution

Policy chains and routing rules that reference a deleted group by name will no longer match any users. Review affected policies before deleting a group.

Add members to a group

1. Select the group in the list.
2. In the Members section of the detail panel, use the user search input to find users by name or email.
3. Select a user from the autocomplete to add them.

Members can also be removed individually from the members list in the detail panel.

Note

For SCIM-managed groups, manually adding or removing members is overwritten on the next SCIM sync from the IdP. Manage membership in your identity provider directory instead.

API reference

# List all groups
GET /api/v1/admin/groups

# Create a group
POST /api/v1/admin/groups
{
  "name": "Engineering",
  "description": "Engineering team",
  "external_group_id": "<entra-or-okta-group-id>"
}

# Update a group
PUT /api/v1/admin/groups/{group_id}
{ ...same fields... }

# Delete a group
DELETE /api/v1/admin/groups/{group_id}

# List group members
GET /api/v1/admin/groups/{group_id}/members

# Add a member
POST /api/v1/admin/groups/{group_id}/members
{ "user_id": "<user-uuid>" }

# Remove a member
DELETE /api/v1/admin/groups/{group_id}/members/{user_id}

---

Per-Group DLP Configuration

Each group can have detector-level DLP overrides that apply in addition to or instead of the org-level DLP policy. Overrides are configured per detector type and specify what action to take when that detector fires for a user in this group.

Available actions

Action	Behavior
SKIP	Disable this detector for users in this group. No action taken even if the pattern matches.
BLOCK	Block the request entirely when the detector fires.
CANCEL	Cancel the in-flight model call and return an error.
REDACT	Replace the matched content with a redaction marker before the request is forwarded.

Configure DLP overrides

1. Select a group in the Admin → Groups panel.
2. In the group detail, navigate to the DLP tab.
3. For each detector, select the action to apply for this group.
4. Click Save DLP Config.

The DLP configuration is a full replacement — saving overwrites the entire previous configuration for the group. To remove all overrides, save an empty configuration.

Detectors available for override include:

• regex — custom regular expression patterns
• ner — named entity recognition (built-in model)
• gliner — GLiNER span-based entity detection
• dictionary — term and phrase blocklist matching
• bloom_filter — probabilistic set membership for large blocklists

API reference

# Get DLP config for a group
GET /api/v1/admin/groups/{group_id}/dlp

# Set DLP config for a group (full replacement)
PUT /api/v1/admin/groups/{group_id}/dlp
{
  "detectors": [
    { "detector_type": "regex", "action": "REDACT" },
    { "detector_type": "ner", "action": "BLOCK" },
    { "detector_type": "dictionary", "action": "SKIP" }
  ]
}

---

SCIM-managed Groups

When a group’s External Group ID is set, Arbitex treats it as IdP-managed. This means:

• Group membership is controlled by the IdP via SCIM 2.0 provisioning.
• The group detail shows a SCIM — IdP-managed group badge in the center panel.
• The group list shows an Entra AD linked indicator next to the group name.
• Membership changes made manually in the Arbitex admin panel are overwritten on the next SCIM sync.

The External Group ID corresponds to the group’s object ID in your IdP (for example, the Object ID of an Entra AD security group). Set this field when creating or editing the group to link it to your directory.

For SCIM token management and sync status monitoring, see SSO Configuration → SCIM Provisioning.

Identifying IdP-managed groups

The Admin → SSO → SCIM Sync tab shows the sync status of all groups:

Status	Meaning
Active — IdP-managed	External Group ID is set; SCIM is configured
Not configured — Local only	No External Group ID; membership is manual

Use this view to confirm that expected groups are receiving IdP-driven membership updates.

---

Model Access Controls

Groups can have explicit model access lists that restrict which AI models members may use. Model access configuration is available in the Model Access tab of the group detail panel.

# Get model access list for a group
GET /api/v1/admin/groups/{group_id}/model-access

# Add a model to a group's access list
POST /api/v1/admin/groups/{group_id}/model-access
{ "model_id": "claude-sonnet-4-6" }

# Remove a model from a group's access list
DELETE /api/v1/admin/groups/{group_id}/model-access/{model_id}

# Get org-wide model access defaults
GET /api/v1/admin/model-access/org-defaults

---

See also

• SSO Configuration — SAML IdP setup and SCIM token rotation
• Groups and RBAC — group-level permission model reference
• Policy Engine Administration — assigning policy chains to groups
• Entra ID SCIM Setup — Entra-specific SCIM provisioning walkthrough

---

Per-Group Compliance Bundle Assignment

Compliance bundles are pre-configured policy packs for regulatory frameworks. Assign specific bundles to a group to apply them in addition to or instead of org-level bundle assignments.

Assign compliance bundles

1. Select the group in the Admin → Groups panel.
2. In the group detail, navigate to the Compliance Bundles tab.
3. Click Edit.
4. Enter the Bundle UUID in the input field and click Add for each bundle to assign. Bundle UUIDs are found in Settings → Policies → Policy Packs.
5. Click Save.

To remove a bundle assignment, click X next to the bundle in the edit view, then save.

Available compliance bundle IDs and their associated frameworks are listed in Compliance frameworks reference.

---

User Roles

Role	Description
USER	Standard user — access to the AI gateway within their group’s policy
ADMIN	Organization admin — full access to Settings, policy configuration, audit logs, and user management

New users receive the USER role by default. Promote a user to ADMIN from Settings → Users → [user] → Edit role.

---

SCIM User Provisioning Details

SCIM-provisioned users are created with the USER role and the display name and email from the SCIM payload. They authenticate via SSO (OIDC or SAML) — no password is set for SCIM-provisioned accounts.

When a SCIM DELETE operation is received for a user, Arbitex sets is_active=false rather than deleting the user record. This preserves audit history and conversation records. The user cannot log in after deactivation.

To reactivate a deactivated user, restore the user in your IdP and trigger a SCIM sync, or contact your platform operator.

---

Import Groups from an IdP via SCIM

To automatically sync group membership from Entra ID or Okta:

1. Set up SCIM provisioning as described in Entra ID SCIM provisioning.
2. Rotate the SCIM bearer token for your org as described in SSO Configuration.
3. In your IdP, configure group provisioning to sync selected groups to Arbitex.

When your IdP provisions a group via SCIM:

• Arbitex creates the group with the display name from the SCIM payload.
• Group members are populated from the SCIM members array.
• Subsequent SCIM PATCH operations update membership incrementally.

To link an existing manually-created group to an Entra AD group:

1. Edit the group.
2. Enter the External Group ID field with the Entra group’s Object ID (found in Azure Portal under the group’s Properties → Object ID).
3. Save.

When SCIM provisions a group with a matching externalId, Arbitex associates the provisioned membership with the linked group. Manual membership changes made in the Arbitex admin panel are overwritten on the next SCIM sync — manage membership in your identity provider directory instead.