Restrict feature access by user or group

Some advanced Assistant features cost more to run or need a controlled rollout. You can limit a feature to named users and identity provider (IdP) groups.

Understand how feature access lists work

Each supported feature has its own access list. Glean enforces the list wherever the feature runs, so a user who isn't on the list can't reach the feature through Assistant.

Per-feature access has the following behavior:

• Turning on a feature for one group doesn't grant that group any other restricted feature.
• Adding a user to a feature access list doesn't grant them access to Assistant. Users still need Assistant access separately.
• A user gets access if they're named directly or belong to at least one allowed group.
• An access list controls who can use a feature, not what content the feature can retrieve. Document permissions stay the same.

Glean resolves group membership from the groups synced through group-based permissions. See Group-based permissions.

Supported features

The following Assistant features support access lists in Admin console → Assistant → Settings. Each row links to the configuration page for that feature where one exists.

Feature	Configuration page
Deep Research	Deep Research
Real-time voice	Real-time voice
Inline artifacts	Inline artifacts
Presentation generation	Slide deck generation
HTML artifacts	–
Audio artifacts	–
Image generation	–
Meeting notes	–

Prerequisites

Before you begin, confirm that you have:

• The Admin or Super Admin role, assigned in Admin console → Users and permissions
• Assistant access for the users you plan to add, since a feature access list doesn't grant Assistant access on its own
• IdP groups synced to Glean, if you plan to allow groups rather than individual users — see Group-based permissions

Restrict a feature to specific users and groups

1

Open the feature settings

Go to Admin console → Assistant → Settings, then expand the section for the feature you want to restrict.

2

Choose the restricted option

Select On for selected teammates and groups.

3

Add users, groups, or both

In Users, add individual teammates. In Groups, add synced IdP groups. Add at least one entry in either field.

4

Save the setting

Click Save.

Changes take around five minutes to take effect. The feature is available only to the users you named and the members of the groups you selected. Everyone else no longer sees it in Assistant.

Limits and sync behavior

Per-feature access has the following limits and behavior:

• A single feature's access list holds a maximum of 1,000 entries. Users and groups share that limit, so 900 users leaves room for 100 groups.
• Group membership changes come from your IdP on its normal sync schedule, so a newly added group member may not get access right away. Security Assertion Markup Language (SAML) and System for Cross-domain Identity Management (SCIM) integrations sync in near real time, and OpenID Connect (OIDC) integrations can take up to three hours.
• Removing a user from an allowed group revokes access on the same schedule. To revoke access immediately, remove the user or group from the access list.

Choose between groups and departments

Both group access lists and department restrictions limit who can use a capability, and they suit different rollout styles.

Consideration	IdP groups	Departments
Source of truth	Groups synced from your identity provider	The Department field in your synced people data
Best for	Security-reviewed rollouts and pilot cohorts that already exist in your IdP	Broad access that follows your org chart
Available for	Assistant features and models	Models

For department-level model control, see Exclude or restrict models. To populate the Department field, see Sync people data.

Frequently asked questions

Glean re-evaluates access on the next request. A user who's removed from the access list loses the feature once the change takes effect, even if their chat is still open.

No. Restricted features don't appear in Assistant for users who aren't on the access list.

Assistant feature access lists apply to Assistant surfaces. Model restrictions apply wherever the model runs, including agents. See Exclude or restrict models.

See also

• Group-based permissions — sync IdP groups and use them as principals across Glean
• Sync people data — populate the user attributes Glean uses for department restrictions
• Glean Enterprise Flex — how FlexCredits apply to premium capabilities