> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.cloudquant.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing Users & Entitlements

> Add, create, deactivate users and grant or revoke dataset entitlements in the CloudQuant Data Liberator admin portal

# Managing users and entitlements

This guide covers the full user lifecycle in the CloudQuant Data Liberator admin portal — from onboarding a new account to assigning and revoking dataset access.

## Prerequisites

* **Super Admin** role for creating users, editing details, assigning entitlements, and deactivating users
* **Admin** or **Super Admin** role to add existing user accounts to the permissions system

Navigate to **Users** in the admin portal sidebar.

## User lifecycle

```mermaid theme={null}
flowchart LR
    A[Create or provision account] --> B[Add to Liberator]
    B --> C[Assign entitlements]
    C --> D[Optional fine-grained rules]
    D --> E[User queries data]
    E --> F[Deactivate when offboarded]
    F --> G[Re-activate if needed]
```

## Creating a new user

Super Admins can create a brand-new account directly from the Users page.

<Steps>
  <Step title="Open Create User">
    Click **Create User** in the top-right of the Users page.
  </Step>

  <Step title="Enter account details">
    Fill in the required fields:

    * **Username** — unique login identifier
    * **Email**
    * **First name** and **Last name**
    * **Company** — select an existing company or type a new one
    * **Password** — minimum 8 characters; use the generate button for a secure password
  </Step>

  <Step title="Submit">
    Click **Create**. The platform account is created. Use **Add Users** (below) to enroll the account in the Liberator permissions system if it does not appear automatically.
  </Step>
</Steps>

## Adding users to Liberator

Before a user can receive dataset entitlements, their account must exist in the Liberator permissions system. Use **Add Users** to enroll accounts that are not yet active in Liberator.

<Steps>
  <Step title="Open Add Users">
    Click **Add Users** on the Users page.
  </Step>

  <Step title="Select from Available Users">
    The **Available Users** tab lists enabled accounts that are not yet in the permissions system. Use the column filters to search by name or email, select one or more users, then click **Add**.
  </Step>

  <Step title="Re-activate deactivated users (optional)">
    The **Deactivated Users** tab lists previously deactivated accounts. Select users and click **Re-activate** to restore their Liberator enrollment. You will still need to re-assign entitlements if they were removed during deactivation.
  </Step>
</Steps>

<Tip>
  You can add multiple users in a single operation. Selected users appear as pills above the table for easy review before confirming.
</Tip>

## Editing user details

Super Admins can update profile information and platform roles from the Users table.

<Steps>
  <Step title="Open the edit dialog">
    In the **Actions** column, click the edit icon for the target user.
  </Step>

  <Step title="Update fields">
    Modify any of:

    * First name, last name, email, company
    * **User Role** — `User`, `Admin`, or `Super Admin` (you can only assign roles at or below your own level)
    * **Password** — optionally set a temporary password (copied to clipboard on save)
  </Step>

  <Step title="Save">
    Click **Save Changes**.
  </Step>
</Steps>

## Assigning dataset entitlements

Entitlements control which datasets a user can query. Super Admins manage entitlements through the **Data Permissions** dialog.

<Steps>
  <Step title="Open Data Permissions">
    In the Users table **Actions** column, click the data-permissions icon for the target user.
  </Step>

  <Step title="Select datasets and groups">
    The permissions table lists all datasets and dataset groups. Check the rows you want to grant:

    * **Dataset** rows grant access to a single dataset
    * **Group** rows grant access to every dataset in that dataset group

    Selected items appear as pills above the table. Remove a pill to revoke that entitlement.
  </Step>

  <Step title="Save changes">
    Click **Save Changes** and confirm. Changes take effect immediately for the user's next query.
  </Step>
</Steps>

### Inherited (locked) datasets

If a user has **connection-level** entitlements, all datasets in that connection are automatically included. These datasets:

* Appear with a lock icon in the permissions table
* Show as **(locked)** on their selection pill
* Cannot be individually deselected until the connection entitlement is removed

Connection entitlements are typically managed through connection-level permission settings rather than the per-user dataset table.

### Viewing a user's access

Click the **View** action on any user to open a read-only summary of their connections, datasets, groups, and role. Super Admins also see a **JSON** tab with the raw permissions payload.

## Removing entitlements

To revoke dataset or group access:

1. Open **Data Permissions** for the user.
2. Deselect the dataset or group row in the table, or click the remove button on its pill.
3. Click **Save Changes**.

Removing a dataset entitlement also removes any fine-grained permission rules attached to that dataset. See [Fine-Grained Permissions](/administration/fine-grained-permissions) for details.

<Warning>
  Deselecting a dataset group removes the group entitlement but does not affect individually assigned datasets within that group unless you deselect those rows separately.
</Warning>

## Deactivating users

Deactivation removes a user from the active Liberator permissions system. The user account is disabled and the user's permissions row is deleted on the backend.

### Single user

<Steps>
  <Step title="Deactivate from the Users table">
    Click the delete icon in the **Actions** column, or open **Data Permissions** and click the trash icon in the modal header.
  </Step>

  <Step title="Confirm">
    Confirm the deactivation. The user moves to the **Deactivated Users** tab in the Add Users dialog.
  </Step>
</Steps>

### Bulk deactivation

Super Admins can deactivate multiple users at once:

1. Select users using the checkboxes in the rightmost column.
2. Click **Deactivate Selected**.
3. Type `DEACTIVATE` to confirm.

<Note>
  You cannot deactivate your own account. Bulk deactivation requires Super Admin role.
</Note>

## Re-activating users

1. Click **Add Users** on the Users page.
2. Switch to the **Deactivated Users** tab.
3. Select the users to restore and click **Re-activate**.
4. Re-assign any dataset entitlements and fine-grained rules that were removed during deactivation.

## Verifying entitlements (end user)

Users can confirm their access from Python:

```python theme={null}
# Datasets the user is entitled to query
liberator.datasets(entitled=True)

# All datasets (including those without access)
liberator.datasets(entitled=False)
```

See [Checking Dataset Access](/python-guide/dataset-access) for schema and detail commands.

## Common tasks

| Task                       | Where                                   | Required role        |
| -------------------------- | --------------------------------------- | -------------------- |
| Create a new account       | Users → **Create User**                 | Super Admin          |
| Enroll an existing account | Users → **Add Users**                   | Admin or Super Admin |
| Grant dataset access       | Users → **Data Permissions**            | Super Admin          |
| Revoke dataset access      | Users → **Data Permissions** → deselect | Super Admin          |
| Change platform role       | Users → **Edit**                        | Super Admin          |
| Deactivate a user          | Users → delete action                   | Super Admin          |
| Re-activate a user         | Users → **Add Users** → Deactivated tab | Admin or Super Admin |