# User Permissions

User Permissions manages members and roles in the current workspace. It addresses two questions: which existing AI Studio accounts can enter the workspace, and which features those members can use within the workspace.

## Users, roles, and tags

Users, roles, and tags have different responsibilities. Define appropriate roles first, then assign them to workspace members to avoid repeatedly configuring many permissions for each member.

| Object | What it manages | How it is used |
| --- | --- | --- |
| User | Member identity, status, and role associations in the current workspace | Invite an existing AI Studio account to join or modify an existing member |
| Role | A reusable set of AI Studio feature permissions | Create, copy, or modify a role, then assign it to members |
| Tag | Organizational and identification information for members | Create tags and use them when inviting or maintaining members |

Tags do not directly grant feature permissions. Whether a member can see or perform an operation still depends on the permissions configured in their assigned roles.

## Recommended sequence

1. Review existing roles to determine whether they already cover the required responsibilities.
2. If no suitable role exists, create or copy one under [Role Permissions](roles.md), then configure global or object permissions.
3. Under [User Management](users.md), invite an existing AI Studio account to the current workspace.
4. Assign one or more enabled roles to the member, and add tags and a description as needed.
5. Before modifying roles or disabling or removing a member, confirm which work and collaborators will be affected.

## What this guide includes

| Page | Content |
| --- | --- |
| [User Management](users.md) | User list, invitations, role assignment, tags, status, removal, and user operation logs |
| [Role Permissions](roles.md) | Role list, creation and copying, permission scopes, role relationships, status, and role logs |

## Scope

This section manages members and product feature permissions at the AI Studio workspace level. Inviting a member associates an existing account with the current workspace; it does not create a new AI Studio account.

To manage MatrixOne database accounts, database roles, or SQL grants, go to [MatrixOne Permissions](../../matrixone/permissions.md). Maintain the two permission systems separately and do not use workspace roles as database roles.

## Documentation tree

```{toctree}
:hidden:
:maxdepth: 1

Users <users>
Roles <roles>
```