Groups & access control

Access for an end user is the sum of several layers, from broadest to most specific:

1. Storefront defaults - what everyone past the door gets.
2. Plans - what their subscriptions add.
3. Group grants - what their group memberships add.
4. Individual grants - per-user exceptions, allow or deny. A deny always wins - it's the only way to take something away that a plan or default would otherwise give.

Groups

On Monitor > Users > Groups, create named groups and add end users to them. Grant a group access to specific Flows, Agents, or Suites and every member gets it - the classic "beta testers" or "enterprise customers" cohort. Group grants are additive only; deny lives at the individual level.

Individual grants

From a user's record you can grant or deny specific products:

• Target - a single Flow or Agent, or a whole Suite.
• Effect - allow (beyond their plans) or deny (despite their plans).
• Scope - organization-wide, or limited to one Storefront.
• Expiry - optional; the grant stops applying after the date.

The same grants can be written via the API when you provision accounts.

Admin actions

On any end user:

• Comp a plan - assign any catalog plan free of charge: full product access and credit allowance, no Stripe subscription. Blocked while the user has a live paid subscription on that plan (cancel it in Stripe first).
• Adjust credits - grant (or claw back) bonus credits on one of their subscriptions without touching the plan.
• Revoke / restore access - revocation signs them out and blocks sign-in within moments; restoring re-opens the door. Their data is kept.
• Delete - for erasure requests: revokes immediately, cancels any Stripe subscription, and removes the identity from your audience.

Every admin action is recorded in an audit trail visible to your organization's members.