> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gurubase.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Groups & Content Access Control

> Partition data sources by user groups so the same guru returns role-appropriate answers

## Overview

Groups let you partition your data sources by user groups so that the same guru returns
role-appropriate answers. The same question asked by a sales team member and a support
engineer can return different context, drawn only from the sources each user is allowed
to see.

Groups are distinct from Gurubase RBAC roles. Roles control who can manage a guru; Groups
control what content each user can see when they ask a question.

There is one special built-in group: **End Users**. Members of this group can only ask
questions and cannot access the admin panel. See [Team Management - End Users Group](/guides/team#end-users-group)
for details. The End Users group can also be used as a regular content group for data
source visibility (e.g., assign certain sources as visible only to End Users).

<Warning>
  Group-based access control currently applies only to authenticated users on the Gurubase
  web UI. The widget embed, public `/api/v1/answer/` endpoint, Slack, Discord, GitHub,
  Jira, Zendesk, MCP server, and chat-completions endpoints remain Everyone-only for now.
  See [Where It Applies](#where-it-applies) for the full list.
</Warning>

## Concepts

### ContentGroup

A ContentGroup is a named collection of users scoped to a single guru. Group names are
unique per guru (two different gurus can both have an "Engineering" group without
conflict), and a user can belong to multiple groups inside the same guru.

### Membership

A Membership links one user to one ContentGroup inside one guru. Memberships are assigned
manually by a guru admin from the Team page.

### Visible To

Every data source has a "Visible to" field. When Visible to is empty, the source is
marked "Everyone" and every authenticated user of the guru sees it in their answers.
When Visible to lists one or more groups, only users with membership in at least one of
those groups can see the source. Everyone and specific groups are mutually exclusive:
selecting a group clears Everyone, and selecting Everyone clears any selected groups.

## Setup

<Steps>
  <Step title="Open the Team page">
    Go to your guru's **Team** page and switch to the **Groups** tab. You must be a
    guru admin (or a super admin on self-hosted) to see this tab.
  </Step>

  <Step title="Create a group">
    Click **Create Group** and enter a name (for example, `Engineering`). The name is
    unique per guru; you cannot create two groups with the same name inside one guru.
  </Step>

  <Step title="Assign members">
    From the **Members** tab, use the Groups column multi-select to assign each team
    member to one or more groups. Users without any group assignment are marked as
    Everyone-only and can only see Everyone sources.
  </Step>

  <Step title="Set Visible to on a data source">
    Open a data source's edit modal (or select multiple sources and use the bulk
    **Set Visible to** action). Pick **Everyone** or one or more specific groups.
    Selecting a group clears Everyone; selecting Everyone clears any previously
    selected groups.
  </Step>

  <Step title="Verify by asking a question">
    Sign in as a user who is a member of the group you assigned to the source and ask
    a question that only the restricted source can answer. The answer should include
    content from that source. Then sign in as a user who is NOT in the group and ask
    the same question; the answer must not reference any restricted content.
  </Step>
</Steps>

## Worked Example

A company uses a single Gurubase guru to answer questions across its Engineering, Sales,
and Support teams. The team admin creates three ContentGroups and assigns each data source
to the appropriate group.

### Groups and Memberships

| User  | Memberships        |
| ----- | ------------------ |
| Alice | Engineering        |
| Bob   | Sales              |
| Carol | Support            |
| Dave  | Engineering, Sales |

### Data Sources

| Source                         | Visible To  |
| ------------------------------ | ----------- |
| Company Handbook               | Everyone    |
| Public FAQ                     | Everyone    |
| Product Overview               | Everyone    |
| Internal API Reference         | Engineering |
| Architecture Decisions         | Engineering |
| Sales Playbooks                | Sales       |
| Pricing Sheets                 | Sales       |
| Customer Runbooks              | Support     |
| Internal Troubleshooting Guide | Support     |

### Shared Question

All four users ask the same question:

> What do we tell a customer asking about enterprise pricing?

### Observed Answers

| User  | Sources Used                                                                                          | Answer Character                                                                               |
| ----- | ----------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| Alice | Company Handbook, Public FAQ, Product Overview                                                        | Generic public answer from the Product Overview. No pricing details.                           |
| Bob   | Company Handbook, Public FAQ, Product Overview, Sales Playbooks, Pricing Sheets                       | Specific pricing tier breakdown drawn from the sales-restricted sources.                       |
| Carol | Company Handbook, Public FAQ, Product Overview, Customer Runbooks, Internal Troubleshooting Guide     | Escalation script from the Customer Runbooks pointing the customer to the sales team.          |
| Dave  | All Everyone sources, Sales Playbooks, Pricing Sheets, Internal API Reference, Architecture Decisions | Union of the Engineering and Sales sources: full pricing detail plus any relevant API context. |

The same question produces four different answers because the backend resolves each
user's ContentGroup membership server-side and filters the retrieved chunks before the
LLM assembles the answer.

## Where It Applies

Group-based access control currently applies to authenticated users on the Gurubase web UI.
The table below shows every user-facing answer surface and its current status.

| Surface                                  | Status         | Notes                                |
| ---------------------------------------- | -------------- | ------------------------------------ |
| Gurubase web UI (authenticated user)     | Groups-enabled | Per-request ContentGroup resolution  |
| Widget embed                             | Everyone-only  | No `data-user-groups` attribute yet  |
| Public POST `/api/v1/<guru>/answer/`     | Everyone-only  | `groups` body field silently ignored |
| Slack bot                                | Everyone-only  | No per-bot group config yet          |
| Discord bot                              | Everyone-only  | No per-bot group config yet          |
| GitHub bot                               | Everyone-only  | No per-bot group config yet          |
| Jira bot                                 | Everyone-only  | No per-bot group config yet          |
| Zendesk integration                      | Everyone-only  | No per-integration group config yet  |
| MCP server                               | Everyone-only  | No groups surface yet                |
| Chat-completions (OpenAI-SDK compatible) | Everyone-only  | No groups parameter yet              |