Access Groups

An access group is a team’s grouping — it decides which features (and therefore which data) a group of people can reach. Add someone to an access group and they can see everything that access group has; that one rule drives most of “who can see what” in Ronja. An access group grants access — it isn’t a folder your data lives in. The mechanics: users are members of access groups, access groups have features, and you can see a resource if you can reach the feature that owns it through one of your access groups.

Manage access groups

Open Access Groups to see each group’s name, description, people and feature coverage. All users means everyone belongs automatically; Selected members means membership is managed individually. Select a group’s name to open its detail page. Use Access Groups above the title to return to the list. Each group and tab has its own link you can bookmark or open in another tab.

General lets you edit the name and optional description, then Save changes.
Members shows who belongs to the group.
Inbox shows requests and drafts awaiting review.

Admins can select New access group, enter an Access group name and an optional Description, then select Create access group. The new group opens on its detail page. The feature coverage link opens Shared features; Users & Access opens the membership matrix.

The Default access group

An access group belongs to one Space, and it works inside it: its members are people who are in that Space, and what it shares reaches nobody outside that Space. For almost every organization there is only one Space, so nothing about this comes up. Every organization starts with one access group, badged “Default”. It has two conveniences switched on: everybody in its Space is automatically a member, and it shares all organization features. It can’t be deleted. Many small teams never need another access group — you create more when different groups should see different things.

Membership

Admins manage who belongs to an access group. The Members tab lists everyone in the organization with Add and Remove buttons (you can’t remove yourself), and the Users & Access matrix handles bulk changes across all access groups at once — see Manage users and roles. When your organization has more than one Space, that matrix shows the people and the access groups of the Space your tab is in — so to change who belongs to a group in another Space, move there first (Switch to this Space on its row on the Spaces page, or the Spaces picker in your account menu). Being in an access group is not what puts somebody in a Space: that is decided on the Space’s own page. And you can only add somebody who is already in the group’s Space — Ronja refuses the rest and names the Space, because a membership in a group whose Space they aren’t in reaches nothing. Let them into the Space first. Admins are in every Space, so they can always be added.

Two access-group-level toggles change the rules, and both are admin-only:

Everyone in a group’s column header on Users & Access (the access group’s All users flag) — everybody who is in the access group’s Space, now and in future, is automatically a member. In the only Space most organizations have, that is everybody in the organization; in another Space it is the people in that Space, and turning it on does not put anybody into the Space. While it’s on, the Members tab labels everyone Included automatically instead of offering Add/Remove; new hires get access without an invite step.
“Allow members to manage this group” (in General) — members with edit access get admin privileges within this access group: they can upload files, manage features, configure table access, and manage members. Useful for a high-trust team space; the elevation applies inside that access group only, and never extends to creating or deleting access groups.

Features: what an access group provisions

An access group reaches a feature when an organization-scope feature is attached to it, or when its All features policy includes the feature. On Shared features, use Browse to understand the features and Access to compare grants across groups.

The Access cells show a green check for full access, an amber half-circle for selected resources, and an outlined dash for no access. A muted mark with a lock means the grant is inherited from All features; it can still be inspected.

Select a cell in Access to inspect its current access and, as an Admin, choose:

Full access — members can use the feature and its resources.
Selected resources — members can use the resources you select.
No access from this group — this group grants no access to the feature.

A feature with Selected resources and no selected items still shares its title and overview with the group. Choose No access from this group to remove that feature attachment.

Select Save changes to apply the choice. Selecting a cell never changes access on its own. The inspector identifies inherited full access and explains why you cannot override it for that feature.

Both access matrices keep the group headings visible while you scroll through their rows. On wider screens, the feature or person names also stay visible when you scroll across groups. The group selector in Access lets you choose which columns to compare. Drag the divider after Feature to resize names, or select Fit names to fit their full text; very long names wrap. The divider also supports arrow keys (Shift for larger steps), Home/End, and Enter to fit. Expanded names scroll with the table when there is too little room to keep them pinned.

Use the All features switch beneath a group’s name, then confirm the change. This policy includes current and future shared top-level features automatically. Turning it off keeps access: every feature the policy includes becomes an individual full-access grant you can then change one by one, so you can turn it off and remove just the features the group should not reach. Features shared after you turn it off are not added automatically. Turn it off before assigning selected resources to a feature it includes. A feature you limited to Selected resources before turning All features on has full access while the policy is on, and keeps full access when you turn it off; choose its selected resources again if it should stay limited.

Give or remove access for several features

As an Admin, tick the box beside each feature in Access, or the box beside Feature to select every feature shown. A bar appears with Give access and Remove access; pick an access group, then confirm. Give access gives that group full access to every selected feature; a feature it already reaches, including one with Selected resources, stays as it is. Remove access removes the group’s access to the selected features, including any selected resources; members keep what their other groups give them. Features included by All features are left out, and the confirmation says how many. Nothing is saved unless every selected feature can be changed, and the message afterwards says how many changed. You can change up to 1000 features at once. Changing the search or a filter clears the selection.

Access adds up across memberships: No access from this group does not cancel a grant from another group. If an all-users group grants full access to a feature, every member of the organization receives that access.

Features aren’t handed over to a single access group. A creator promotes a feature to Organization scope (an admin approves), and an admin then attaches it to the access groups that should reach it on the access matrix — or uses the access group’s All features policy to include it automatically.

What access groups don’t own

Explorations do not belong to access groups. A conversation connects to a team only when its owner shares it — with individual people or with an access group, in which case everyone in that access group can open it.

Deleting an access group

Only Admins can delete an access group. Open the group’s General settings, select Delete access group, and confirm Delete. The Default group shows why it can’t be deleted instead of offering a delete action. Deletion is a soft delete: the access group moves to the trash for 30 days, but members lose access immediately and its automations pause. Restoring within the window brings it back and resumes the automations; after 30 days it’s purged permanently. See Restore from trash.

Still unsure when to reach for an access group versus a feature? See What’s the difference?.