Users and groups

Tenant admin

Permissions live on groups, not on users

Almost nothing is granted to a user directly. Queues, storage, GPU limits, the right to add a job at all - these belong to a user group, and a user inherits them by being a member. A user in no group can do nothing.

Users

The table lists every account in the tenant with its id, username, name, email, last-seen date, token balance and status.

Creating one

CREATE USER takes an email address and a name. The account is created and the person is invited to set their own password.

1. CREATE USER, fill in the address and name.
2. Open the new user and add them to a group. Until you do, they have no queues and no permission to add jobs.
3. Give them tokens, or add them to a project that has some.

Skipping steps 2 and 3 produces the most common support question in a new tenant: “I can sign in but the queue selector is empty.”

Editing one

Opening a user lets you adjust their token balance, their activation (deactivating blocks sign-in without deleting anything) and their group membership.

User groups

The second table. A group carries a priority, which decides whose jobs win when several are waiting for the same capacity - higher goes first.

Limits

Setting	Effect
Max GPUs per job	Ceiling on a single job’s request
Max total GPUs	Ceiling across all of the member’s running jobs

Both must be non-negative integers; an empty or invalid value is refused rather than saved.

These bound what the submission form even offers. A user cannot select past them.

Permissions

Toggles on the group:

Permission	Grants
Add jobs	Submitting at all. Off by default on a new group
Private ports	Opening a port on the private network
Public ports	Opening a port to the internet
Add registries	Adding their own Docker registries
Require project	Forces every job to name a project. Removes the “no project” option
Disable login	Blocks sign-in for the whole group

Add jobs is the one people forget

A group without it produces an empty queue selector and a disabled submit button, with no obvious cause from the user’s side. If someone reports that they cannot submit anything, check this first.

Queues and storage

A group grants access to specific queues and storage buckets. This is how a user comes to see a queue at all.

Granting the group a queue is not the same as that queue being able to mount storage - the queue has its own storage links, set on the Queues page. Both have to be right before a user can mount anything.

LDAP

Where the tenant has LDAP configured, groups can be imported from the directory rather than maintained by hand.