> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataerai.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Permissions, people & teams
> Share data with specific people, whole groups, or the public — and manage the users, groups and organizations behind those grants.
Use this tutorial to share data without copying it.
You can share with:
* One person.
* A group.
* Everyone who can sign in, when public access is allowed.
You'll learn how to:
* Find the organization you administer.
* Add a second person.
* Create a group.
* Grant access to a group or individual.
* Understand **Read**, **Write**, and **Admin** roles.
Good to know:
* Organization admins manage members and groups from **Settings**.
* Sharing is controlled on projects, collections, and assets.
* Public access is read-only.
Reference docs: [Permissions](/sharing/permissions), [Public access](/sharing/public), [People & groups](/sharing/people-and-groups).
## Find your organization
Group creation and member management happen inside an **organization**, so first
resolve the organization you administer.
**In the app**
1. Open the user account menu in the top-right and choose **Settings**.
2. In the Settings sidebar open **Organizations** to see the organizations you
belong to. The same orgs appear on the `/admin/organizations` admin page
(**Name | Members | Domains | Created**), where you administer the ones you
own.
**From code** — use your account and organization lists to find the organization
you administer.
`GET /api/me/` returns `sole_organization_id` and `admin_organizations[]`;
`GET /api/organizations/` lists the organizations you can administer.
## Add a second person
Collaboration needs at least two people. Ask the second person to sign up or
sign in with Globus, then add them to your organization so they appear in people
search and can join projects.
**In the app**
1. Open your Dataerai site in a fresh/incognito window. On the sign-in screen,
click **Sign up** to reach `/signup`.
2. Fill **Full name**, **Email**, **Password**, and **Confirm password**, then
submit.
3. Back in your main window, open the org at `/admin/organizations`, click the
org name, and use **New member** / add-by-email to add the new person
(per-member role is *member* or *admin*).
**From code** — user creation is intentionally not shown in the public
tutorials. After the person has an account, add them to your organization with
the organization members API or from **Settings**.
## Create a group and add the member
A **group** is a named bundle of users inside one organization. Grant a group
access to an item once, and everyone in it gets that access. Creating a group and
managing its members require **org-admin** of the target organization.
**In the app**
1. Open the user account menu → **Settings**, then choose **Groups** in the sidebar.
2. Click **Add group** (a draft named *New Group* opens); rename it, and if you
belong to more than one org pick the org under **Create in**.
3. In the group's **Members** tab, type the second user's name or email into the
**Add members by name or email…** box, select them, and **Save**.
**From code** — create the group, then add the members.
Use `POST /api/groups/` (name unique per organization), then
`POST /api/groups/{id}/members/` with `{"user_ids": [...]}`. The member-add
call returns `204`, so re-GET `/api/groups/{id}/members/` to confirm.
## Roles & what each one grants
The sharing UI exposes three preset **roles** per object type — **Read**,
**Write**, and **Admin**. Public access is always read-only.
| Role | What it allows |
| --------- | -------------------------------------------------------------------------------- |
| **Read** | View metadata, content, notes, and project or collection listings. |
| **Write** | Read, plus edit metadata, content, and notes where that object supports editing. |
| **Admin** | Write, plus share the object with other people or groups. |
Two roles are easy to conflate but are **separate** from these share-grant
presets: an **organization** membership role is *member* or *admin*, and a
**project** membership role is *member*, *manager*, or *admin* (these auto-create
Read / Write / full grants on the project).
## Grant access to the group, a user, or the public
Permissions are granted to a person, a group, or the public. You must have
**Admin** access on the object to share it.
**In the app**
1. Close Settings, navigate into the project, and select the asset's row.
2. In the bottom selection toolbar click **Permissions** to open the
**Record permissions** modal.
3. Use the **Groups** tab to search for *Lab Team* and add it, or the **Users**
tab to add the second user; set each one's role with the per-row dropdown
(**Read** / **Write** / **Admin**). To publish, toggle **Make publicly
available** (a public read-only grant).
**From code** — use the same **Read**, **Write**, and **Admin** role names shown
in the app. List a group's assignments to see every item the group can now
reach.
These grants use the public permissions API.
## Alternative paths
* **Project membership** — `POST /api/projects/{project_id}/members/` with
`{"user_id", "role"}` (*member* / *manager* / *admin*) adds someone to a whole
project's roster and auto-creates the matching grants across the project and its
collections. The target user must belong to the project's organization.
* **System-admin user management** — `/api/admin/users/` (SysAdmin only) can list,
inspect, attach users to organizations, and flip `is_active` / `is_system_admin`.
It **cannot create users** — signup is still the only way a user comes into
existence.
## Next steps
* [Account & profile](/tutorials/08-your-profile/08-your-profile)
* [See where data came from — provenance](/tutorials/05-provenance/provenance)
* [People & groups reference](/sharing/people-and-groups)