> Public product help. This page has no customer entries, projects, chat transcripts, API keys, or horizon contents.
> Reading that data requires `Authorization: Bearer` (a signed-in app session JWT, or a Headless access token).
> Do not call Supabase `/rest/v1` with a Headless JWT. Data reads go through `/casc/v1/headless/v1/rest`.

# Roles and Access

Every user has an account type stored as `user_type` in the database and exposed in the app as **account type** on the profile menu. Roles control Settings pages, horizon visibility, and admin tools.

## Account types

| Role | Typical capabilities |
| --- | --- |
| **user** | Projects, Horizon (for assigned/public horizons), Settings (ingestion, schedules, prompts, tools, views, user preferences). Create and own private ingestion groups and prompts. |
| **admin** | Everything users have, plus Settings → Admin (user invites, AI provider registry, shared Google OAuth apps), **Headless** (integrations review), Help → System Test, read instance System Settings (Settings → System), see all private groups/prompts on the horizon. |
| **superadmin** | Everything admins have, plus Settings → Superadmin (create/delete horizons, write instance System Settings, embedding model, assign admin roles). |

## Horizon access

A user can work on a horizon when any of the following is true:

- The horizon is marked **public**.
- The user is the **horizon owner**.
- The user has an explicit assignment in **user horizons** (admin-managed).
- The user is **admin** or **superadmin** (override).

Switch horizons under **Settings → User → Active Horizon**. Ingestion groups must be **assigned** to a horizon to appear on that horizon's pages.

## Privacy on groups and tools

- **Private ingestion group** — visible to owner and admins; other users do not see it in lists or tool key pickers.
- **Private tool** — same pattern for vector tools.
- **Private prompt** — hidden from non-owners unless admin.
- **Public project** — any user on the horizon can open the project; **private project** — owner and admins only.

## What each role needs to build ingestion

| Task | user | admin | superadmin |
| --- | --- | --- | --- |
| Create ingestion group on assigned horizon | Yes | Yes | Yes |
| Connect personal Google for Sheets/Drive | Yes | Yes | Yes |
| Publish shared Google OAuth app for domain | No | Yes | Yes |
| Set instance System Settings (Settings → System) | No | Read only | Write |
| Configure XE.net API keys (instance system settings) | No | Read only | Write |
| Headless integrations (mint API credentials) | No | Yes | Yes |
| Run System Test harness | No | Yes | Yes |
| Create new horizon | No | No | Yes |

## Read-only flag

Admins can mark invited users as read-only in user management. Treat this as a profile flag unless your deployment adds stricter enforcement — verify behavior with your administrator.