People and groups

Portward keeps no user accounts and no groups of its own. People sign in with their work account at your company directory, and the groups the directory sends decide what each person may do. You manage people where you already do, in your directory.

How someone gets in

1. Your directory lets them sign in to the Portward app. In Entra ID and Okta you assign the app to groups or people. Disable someone there when they leave. The gateway asks your directory again whenever a sign-in is renewed, at least every hour, so a disabled person loses access within the hour.
2. The gateway checks their role. Members of an admin group are admins. Members of a user group are data users. Everyone else who signs in is refused with “Not allowed”, and the gateway’s log names their sign-in id.
3. Each dataset checks their groups. A dataset limited to groups is for members of those groups only. See Dataset access.

Sign-in setup has the steps to register the app in each directory and send groups.

Roles

Role	Who	What they can do
Admin	Members of an admin group, or people named in admin_subjects in the config file	Use the admin connector and the admin console: connect sources, set access and column rules, add context, read records. Also use the data connector.
Data user	Members of a user group, or people in users in the config file	Use the data connector: ask questions about the datasets they may use.

There is no read-only admin role and no per-source admin. Every admin can change every source.

Who counts as a data user

This depends on the users line in the gateway’s config file:

users in the config file	Who may use the data connector
users = [] (what portward init and the AWS, Azure and Google Cloud templates write when you list no other users)	Admins and members of a user group
users = ["@acme.com"] or a list of people	Admins, members of a user group, and the people or email domain listed
No users line	Everyone your directory lets sign in, whatever the user groups say

The console’s Overview warns you when the last case applies: “Anyone who can sign in through your company directory can use the data connector, whatever the user groups say. To limit it to user groups, add users = [] under [auth] in the config file.” The Access page says the same under Data users. Add users = [] to the [auth] section to close it. An email domain works only when your directory marks emails as verified, which Entra ID doesn’t (Install, step 6).

Add an admin group or a user group

Groups come from two places:

• The config file, admin_groups and user_groups under [auth]. On AWS these are the stack’s Admin groups and User groups parameters. The console shows them under “From the config file” and can’t remove them.
• The console. Open Access. Under Admins, type the group in Add an admin group and select Add. Under Data users, use Add a user group. These show under “Added by an admin”.

Adding a group gives more access, so the console asks you to sign in again before it saves. Removing a group added in the console is saved at once. You can’t remove a group that would leave you without admin access yourself; another admin has to do that.

Write the group exactly as your directory sends it. Entra ID sends each group’s Object ID, such as 5b6e3c1a-..., not its display name. Okta, Google with a groups claim and most others send the name. The Access page’s People list shows the groups each person’s sign-in carried, which helps you copy the exact value.

Departments, teams and projects

Portward has no department, team or project objects. Model each one as a group in your directory, then give that group what it needs in Portward. For example, at a company that uses Okta:

In your directory	In Portward
finance	A user group. finance.invoices and finance.payroll are limited to it.
sales-emea	A user group. crm.opportunities is limited to sales-emea and sales-leadership.
project-atlas	A user group. atlas.costs is limited to it, and only it sees the supplier column’s real values.
hr-managers	Not a user group by itself. On hr.employees, people in it see salary as Real value while everyone else sees it Masked.
data-platform	An admin group: they connect sources and set the rules.

A person in several groups gets the datasets of all of them, and for each column the most open view any of their groups has. To end a project, remove the group from its datasets in Portward, or remove the people from the group in your directory.

A group you use in Portward has to reach the gateway in the sign-in token:

• Entra ID sends groups once the app has a groups claim, as Object IDs (Microsoft Entra ID).
• Okta sends the groups that pass the app’s groups claim filter (Okta). A new group has to match the filter too.
• Google Workspace doesn’t send groups to the gateway. With Google, admins are named by email in admin_subjects and data users by email or domain in users, and datasets can’t be limited by group (Google Workspace).

The gateway keeps only the groups it uses (admin groups, user groups and the groups datasets are limited to) in the tokens it gives Claude and ChatGPT. When you limit a dataset to a group that wasn’t used before, people get it at their next sign-in renewal, within the hour.

See who has signed in

Access, then People, lists everyone signed in through the directory recently: name, email, role, the groups their sign-in carried, and when they signed in. The Overview’s Last 7 days counts the people who used the gateway.

Next

Dataset access: give each group the datasets it needs.