Extending the Factory Organization Model with User Groups

In August we announced the Factory Organization Model, which enables enterprises to split a deployment into organizations. Each organization has its own members, admins, integrations, model access, data residency, and usage limits, and those settings apply to everyone in it.

Organizations work when part of the business needs a separate boundary. They don't cover cases when an organization needs to apply different settings to different individuals, such as tailored usage limits or model access for platform engineers and contractors. Previously, admins handled this with per-user overrides or by creating a separate organization for each role, which meant duplicating integrations and policies.

User Groups covers this case. Groups sync from your identity provider through Directory Sync. You configure settings on a group, such as a monthly usage limit or model access, and choose the organizations they apply to. Members get those settings in each of those organizations. When group membership changes in your IdP, Factory picks up the change.

Groups are configured in the Enterprise Admin Console, and group usage limits can also be managed programmatically through the Organization API, to scale administration across thousands of users without tedious click-ops.

Organizations define boundaries. User Groups sets per-person settings within and across them.

How User Groups work

Members get their group's settings in the organization. Members not in either group get the organization's global settings.

Usage limits and model controls follow the same hierarchy. Each organization sets a default for everyone in it, a group mapped into the organization replaces that default for its members, and an individual override replaces both. Factory determines what setting should apply using the following hierarchy, where the first level that is set wins:

1. An individual override for that user, used for exceptions.
2. The user's group settings in that organization.
3. The organization default.

For usage limits, a group limit can be higher or lower than the organization default. If a user is in several groups with limits, the highest one applies, so joining another group never lowers a user's limit. With no limit set at any level, usage is unlimited.

For model access, each model resolves on its own. A group can allow a model the organization's policy doesn't include or block one it does, and models the group leaves at the default follow the organization's policy. If a user is in several groups, a model is allowed when any of those groups allows it.

Settings are resolved on each request, so changes apply on a member's next request. Enforcement, the manager usage table, and weekly usage emails all use the same resolution.

How User Groups fit with Organizations

Groups come from your identity provider and are mapped into specific organizations in the same hierarchy.

Solid lines show the organization hierarchy. Dotted orange lines show where each group is mapped.

Group settings are configured per organization, so the same group can have a higher limit or broader model access in one organization and no settings in another. Mapping a group into an organization doesn't change the organization's integrations, residency, or admins.

How User Groups and Organizations work together

Organizations and User Groups handle different levels of control. An organization sets the boundary for a part of the business: its integrations, credentials, data residency, admins, and the default settings for everyone in it. User Groups adjusts usage limits and model access for specific people within that boundary.

In practice, create an organization when a team needs its own integrations, residency, or admins. Use a group when people who share those things need different settings.

The two are meant to be used together. Groups come from your IdP and aren't tied to one organization, so when you add an organization you can map existing groups into it instead of configuring each person again. Changes to group membership apply in every organization the group is mapped to.

Managing groups

User Groups lives in the Enterprise Admin Console, next to organizations, billing, and identity. Enterprise owners see every group synced through Directory Sync, configure group settings, and choose the organizations they apply to. Before saving, the console lists each organization whose settings will change.

Other details:

• Configurations are keyed to the group's directory ID, so renaming a group in your IdP doesn't affect its configuration.
• In usage settings, admins can expand any user to see which level sets their limit.
• Managers can read and set group limits through the Organization API, up to 100 groups per request. Group model access is configured in the Admin Console.
• Every change, from the console or the API, is recorded in the audit log.

Group membership only affects settings on the User Groups page. Roles still come from your existing group-to-role mapping.

User Groups is available to enterprise customers with Directory Sync configured. See the User Groups docs to set them up.