Users, roles, and sessions

SoAI gives each signed-in person a separate account, workspace, conversations, prompts, messaging accounts, and interface preferences. Administrators create accounts and control role permissions from the SoAI WebUI.

Create and manage accounts

A new installation opens the setup wizard because no users exist. The account created there is the first Administrator. After setup, sign in with that account and add other users from Settings. See SoAI quickstart for the complete first-run sequence.

Create and manage users

  1. Select the Settings button at the right of the header, then Settings > Users.
  2. Select Create user.
  3. Enter a username containing 3 to 50 ASCII letters, numbers, dots, underscores, or hyphens. Enter a password containing 8 to 1,024 characters, then choose Administrator or Regular user.
  4. Create the account. Use Refresh when you need to reload the list.

The Users tab is available only to an Administrator with User administration (USER_ADMIN). Each account row shows its role and workspace folder. The same permission controls Rename, Password, Folder, and Delete actions.

The Role selector appears after at least two accounts exist. SoAI rejects deletion of the final user or final Administrator and rejects demotion of the final Administrator. Changing a user's workspace folder removes that user's conversation folder overrides outside the new folder.

Select Rename on an account row to enter a new username and Your current password. Renaming keeps the account's files and folder paths, but signs out its other sessions. Select Folder to choose a new default folder or Use default folder to reset it.

Change passwords and active sessions

Select Password on an account row. Enter Your current password, a New password containing 8 to 1,024 characters, and Confirm new password, then select Change password.

Changing an account password revokes that account's active sessions. If an Administrator changes their own password, SoAI replaces the current session so the browser can remain signed in with the new credentials. Logout on an account row applies only to the signed-in account.

The Users tab also lists Active devices and sessions for the signed-in Administrator. Select Revoke beside another session, Logout beside the current one, or Revoke all to sign out every active device, including the current browser. Regular users do not see the Users tab and cannot use these account-management controls.

Roles and account ownership

Roles determine which protected actions an account can perform. Open Settings > ACL as an Administrator with ACL administration (ACL_ADMIN) to review or change role permissions. See Access control for the complete permission table and lockout protections.

Understand account ownership

Conversations, prompts, uploaded avatars, layouts, and personal preferences belong to their user. Messaging accounts and the provider conversations they create also belong to the user who connected them. The Messaging tab requires Model read access (MODEL_READ), Public inference API access (OPENAI_API), and MCP usage (MCP_USE).

Related documentation