Configure groups, access, and quotas

Before you begin

At least one provider model configured in the organization
Access to the Admin UI as an organization admin or server admin

Configure a group grant

1
Create or select a group
Open Directory → Groups at /groups. Select Add Group or open an existing group.
2
Add members
Use Members to add the intended organization users.
3
Open Model Access
Enable Has Access for each required base model or alias.
4
Set optional daily quotas
Enter Daily Token Quota and/or Daily Cost Quota ($). A blank quota is unlimited for that dimension. Daily totals reset at midnight in the organization's configured time zone.
5
Apply changes
Save the Model Access changes, then verify the member's model picker and remaining quota.

Understand how access is calculated

Use this reference when a member sees the wrong models or when a quota does not behave as expected. Roles, groups, and quotas solve different parts of the access decision.

Control	What it controls	What it does not control
Admin or Member role	Administrative capabilities inside one organization	A Member's model list by itself
Server-admin capability	Deployment-wide operations and organization selection	Membership in an organization
Group membership	Which model or alias grants apply to a Member	An organization Admin's catalog visibility
Model Access setting	Access plus optional daily token and cost quotas for one group and model or alias	Automatic provider switching
User quota settings	A user's daily budget and optional per-model overrides	Access to a model that no group grants

Control: Admin or Member role
What it controls: Administrative capabilities inside one organization
What it does not control: A Member's model list by itself

Control: Server-admin capability
What it controls: Deployment-wide operations and organization selection
What it does not control: Membership in an organization

Control: Group membership
What it controls: Which model or alias grants apply to a Member
What it does not control: An organization Admin's catalog visibility

Control: Model Access setting
What it controls: Access plus optional daily token and cost quotas for one group and model or alias
What it does not control: Automatic provider switching

Control: User quota settings
What it controls: A user's daily budget and optional per-model overrides
What it does not control: Access to a model that no group grants

Understand how group and user budgets combine

Layer	Scope	Effective behavior
Group model or alias quota	One member, model or alias, and group	Across granting groups, a blank value in any grant makes that dimension unlimited; otherwise the highest group value applies.
Per-user model override	One member and model or alias	Replaces the group-derived daily token value. A configured cost override replaces the group-derived cost value. Access is still required through a group.
User-wide daily budget	One member in the organization	In Quotas & Tokens, choose tokens or cost and set the daily budget across models. You can change the unit only before the member has usage after midnight in the organization's configured time zone.

Layer: Group model or alias quota
Scope: One member, model or alias, and group
Effective behavior: Across granting groups, a blank value in any grant makes that dimension unlimited; otherwise the highest group value applies.

Layer: Per-user model override
Scope: One member and model or alias
Effective behavior: Replaces the group-derived daily token value. A configured cost override replaces the group-derived cost value. Access is still required through a group.

Layer: User-wide daily budget
Scope: One member in the organization
Effective behavior: In Quotas & Tokens, choose tokens or cost and set the daily budget across models. You can change the unit only before the member has usage after midnight in the organization's configured time zone.

Every applicable boundary must allow the request; a more permissive setting does not cancel a stricter applicable boundary.

To edit user-wide and per-model values, open /users, select the user, and open Quotas & Tokens. Use Quota unit and daily budget for the organization-wide user limit, then apply per-model overrides only where an exception is required.

For integrations: choose the API-key owner

Use a member-owned key when an integration should see only the models and aliases granted to that member through groups. Use an organization-owned key for a shared service that should use organization-level model scope instead of one member's model access.

Member keys must be allowed by organization policy. Members manage their keys from the API Keys card on /dashboard; admins manage policy and organization-owned keys at /api-keys. Key token and cost budgets reset at midnight in the organization's configured time zone.

Create API keys and connect agentsFollow the complete key, scope, budget, and API setup workflow.

For operators: distinguish quotas from rate limits

This section is only for private-deployment operators who have access to the Server environment. Organization admins can manage group, user, and API-key budgets without that access.

Boundary	Configured in	Typical response
Edition or license entitlement	The active Community Edition rules or licensed deployment assignment	A license request cap uses HTTP 402. Other entitlement failures can use HTTP 403; inspect error.code.
Native /v1 AI usage quota	Groups, user Quotas & Tokens, or an API key	HTTP 402 with error.code quota_exceeded when the applicable usage quota is exhausted.
OpenAI-compatible /openai/v1 AI usage quota	Groups, user Quotas & Tokens, or an API key	HTTP 429 with error.type set to too_many_requests when the applicable usage quota is exhausted.
Transport or concurrency rate limit	Server deployment environment and runtime limiter	HTTP 429, including too_many_requests or too_many_parallel_streams.

Boundary: Edition or license entitlement
Configured in: The active Community Edition rules or licensed deployment assignment
Typical response: A license request cap uses HTTP 402. Other entitlement failures can use HTTP 403; inspect error.code.

Boundary: Native /v1 AI usage quota
Configured in: Groups, user Quotas & Tokens, or an API key
Typical response: HTTP 402 with error.code quota_exceeded when the applicable usage quota is exhausted.

Boundary: OpenAI-compatible /openai/v1 AI usage quota
Configured in: Groups, user Quotas & Tokens, or an API key
Typical response: HTTP 429 with error.type set to too_many_requests when the applicable usage quota is exhausted.

Boundary: Transport or concurrency rate limit
Configured in: Server deployment environment and runtime limiter
Typical response: HTTP 429, including too_many_requests or too_many_parallel_streams.

The request limiter protects Server capacity. Changing it does not grant models, raise an AI usage budget, or increase a license entitlement.

Core request-rate settings

ORCHESTRIS_RATE_LIMIT__ENABLED=true
ORCHESTRIS_SYNC__PRE_AUTH_IP_RATE_LIMIT_ENABLED=true
ORCHESTRIS_SYNC__JWT_RATE=20
ORCHESTRIS_SYNC__JWT_BURST=40
ORCHESTRIS_SYNC__IP_RATE=500
ORCHESTRIS_SYNC__IP_BURST=1000

Configure a group grant

1
Create or select a group
Open Directory → Groups at /groups. Select Add Group or open an existing group.
2
Add members
Use Members to add the intended organization users.
3
Open Model Access
Enable Has Access for each required base model or alias.
4
Set optional daily quotas
Enter Daily Token Quota and/or Daily Cost Quota ($). A blank quota is unlimited for that dimension. Daily totals reset at midnight in the organization's configured time zone.
5
Apply changes
Save the Model Access changes, then verify the member's model picker and remaining quota.

Understand how access is calculated

Use this reference when a member sees the wrong models or when a quota does not behave as expected. Roles, groups, and quotas solve different parts of the access decision.

Control	What it controls	What it does not control
Admin or Member role	Administrative capabilities inside one organization	A Member's model list by itself
Server-admin capability	Deployment-wide operations and organization selection	Membership in an organization
Group membership	Which model or alias grants apply to a Member	An organization Admin's catalog visibility
Model Access setting	Access plus optional daily token and cost quotas for one group and model or alias	Automatic provider switching
User quota settings	A user's daily budget and optional per-model overrides	Access to a model that no group grants

Control: Admin or Member role
What it controls: Administrative capabilities inside one organization
What it does not control: A Member's model list by itself

Control: Server-admin capability
What it controls: Deployment-wide operations and organization selection
What it does not control: Membership in an organization

Control: Group membership
What it controls: Which model or alias grants apply to a Member
What it does not control: An organization Admin's catalog visibility

Control: Model Access setting
What it controls: Access plus optional daily token and cost quotas for one group and model or alias
What it does not control: Automatic provider switching

Control: User quota settings
What it controls: A user's daily budget and optional per-model overrides
What it does not control: Access to a model that no group grants

Understand how group and user budgets combine

Layer	Scope	Effective behavior
Group model or alias quota	One member, model or alias, and group	Across granting groups, a blank value in any grant makes that dimension unlimited; otherwise the highest group value applies.
Per-user model override	One member and model or alias	Replaces the group-derived daily token value. A configured cost override replaces the group-derived cost value. Access is still required through a group.
User-wide daily budget	One member in the organization	In Quotas & Tokens, choose tokens or cost and set the daily budget across models. You can change the unit only before the member has usage after midnight in the organization's configured time zone.

Layer: Group model or alias quota
Scope: One member, model or alias, and group
Effective behavior: Across granting groups, a blank value in any grant makes that dimension unlimited; otherwise the highest group value applies.

Layer: Per-user model override
Scope: One member and model or alias
Effective behavior: Replaces the group-derived daily token value. A configured cost override replaces the group-derived cost value. Access is still required through a group.

Layer: User-wide daily budget
Scope: One member in the organization
Effective behavior: In Quotas & Tokens, choose tokens or cost and set the daily budget across models. You can change the unit only before the member has usage after midnight in the organization's configured time zone.

Every applicable boundary must allow the request; a more permissive setting does not cancel a stricter applicable boundary.

For integrations: choose the API-key owner

Create API keys and connect agentsFollow the complete key, scope, budget, and API setup workflow.

For operators: distinguish quotas from rate limits

This section is only for private-deployment operators who have access to the Server environment. Organization admins can manage group, user, and API-key budgets without that access.

Boundary	Configured in	Typical response
Edition or license entitlement	The active Community Edition rules or licensed deployment assignment	A license request cap uses HTTP 402. Other entitlement failures can use HTTP 403; inspect error.code.
Native /v1 AI usage quota	Groups, user Quotas & Tokens, or an API key	HTTP 402 with error.code quota_exceeded when the applicable usage quota is exhausted.
OpenAI-compatible /openai/v1 AI usage quota	Groups, user Quotas & Tokens, or an API key	HTTP 429 with error.type set to too_many_requests when the applicable usage quota is exhausted.
Transport or concurrency rate limit	Server deployment environment and runtime limiter	HTTP 429, including too_many_requests or too_many_parallel_streams.

Boundary: Edition or license entitlement
Configured in: The active Community Edition rules or licensed deployment assignment
Typical response: A license request cap uses HTTP 402. Other entitlement failures can use HTTP 403; inspect error.code.

Boundary: Native /v1 AI usage quota
Configured in: Groups, user Quotas & Tokens, or an API key
Typical response: HTTP 402 with error.code quota_exceeded when the applicable usage quota is exhausted.

Boundary: OpenAI-compatible /openai/v1 AI usage quota
Configured in: Groups, user Quotas & Tokens, or an API key
Typical response: HTTP 429 with error.type set to too_many_requests when the applicable usage quota is exhausted.

Boundary: Transport or concurrency rate limit
Configured in: Server deployment environment and runtime limiter
Typical response: HTTP 429, including too_many_requests or too_many_parallel_streams.

The request limiter protects Server capacity. Changing it does not grant models, raise an AI usage budget, or increase a license entitlement.

Core request-rate settings

ORCHESTRIS_RATE_LIMIT__ENABLED=true
ORCHESTRIS_SYNC__PRE_AUTH_IP_RATE_LIMIT_ENABLED=true
ORCHESTRIS_SYNC__JWT_RATE=20
ORCHESTRIS_SYNC__JWT_BURST=40
ORCHESTRIS_SYNC__IP_RATE=500
ORCHESTRIS_SYNC__IP_BURST=1000

Configure groups, access, and quotas

Before you begin

Configure a group grant

Create or select a group

Add members

Open Model Access

Set optional daily quotas

Apply changes

Understand how access is calculated

Understand how group and user budgets combine

For integrations: choose the API-key owner

For operators: distinguish quotas from rate limits

Next steps

Configure providers, models, and aliases

Manage users and invitations

Create API keys and connect agents

Troubleshoot errors and collect diagnostics

Configure groups, access, and quotas

Before you begin

Configure a group grant

Create or select a group

Add members

Open Model Access

Set optional daily quotas

Apply changes

Understand how access is calculated

Understand how group and user budgets combine

For integrations: choose the API-key owner

For operators: distinguish quotas from rate limits

Next steps

Configure providers, models, and aliases

Manage users and invitations

Create API keys and connect agents

Troubleshoot errors and collect diagnostics