Skip to main content

Access Control

Manage who can access what in WizChat.

Access Control Model​

WizChat uses Role-Based Access Control (RBAC) at multiple levels:

  1. Account level - Who can access your account
  2. Team level - Who can access team resources
  3. Chatbot level - Who can access specific chatbots
  4. Document level - Who can access specific documents
  5. MCP server level - Who can use specific integrations
  6. Metric level - Who can see specific dashboard metrics

Account Access​

Single Sign-On (SSO)​

Business plans can enable SSO:

  • SAML 2.0
  • Google Workspace
  • Microsoft Azure AD
  • Okta

Multi-Factor Authentication (MFA)​

Enable MFA for additional security:

  1. Go to "Profile" > "Security"
  2. Click "Enable MFA"
  3. Scan QR code with authenticator app
  4. Enter verification code
  5. Save backup codes

Team Access​

See Roles & Permissions for details.

RoleAccess Level
OwnerFull access, billing
AdminManage team, chatbots
MemberUse shared chatbots

Chatbot Access​

Control who can access each chatbot:

LevelWho
Owner onlyJust the chatbot owner
TeamAll team members
Specific peopleInvited individuals

See Sharing Chatbots for details.

Document Access​

Control access to individual documents:

LevelDescription
PublicAll chatbot users
AuthenticatedLogged-in users only
RestrictedSpecific email addresses

See Document Access Control for details.

Domain Restrictions​

Restrict chatbot access to users from specific email domains:

  1. Open your chatbot
  2. Go to the "Settings" tab
  3. Open "Manage Access"
  4. Add authorized email domains
Example DomainWho Can Access
acme.comOnly @acme.com email addresses
acme.com, partner.orgBoth @acme.com and @partner.org

See Access Modes - Domain Restrictions for details.

MCP Server Access​

Control which chatbot users can use each MCP integration:

LevelDescription
PublicAll chatbot users can use the server
RestrictedOnly specific users or email groups

See MCP Overview for details.

Metric Access​

Control which chatbot users can see individual dashboard metrics:

LevelDescription
Public (default)All chatbot users see the metric
RestrictedOnly specific users or email groups

Restricted metrics are silently hidden from unauthorized users — they simply don't appear on the dashboard.

See PostgreSQL Metrics - Access Control for details.

API Access​

API Key Permissions​

When creating API keys, set permissions:

  • Read-only
  • Read-write
  • Full access

IP Allowlisting​

Restrict API access to specific IPs:

  1. Go to "Settings" > "API"
  2. Click "IP Restrictions"
  3. Add allowed IP addresses
  4. Click "Save"

Session Management​

Active Sessions​

View and manage active sessions:

  1. Go to "Profile" > "Security"
  2. Click "Active Sessions"
  3. See all logged-in devices
  4. Revoke sessions as needed

Session Timeout​

Configure session timeout:

  • Default: 30 days
  • Configurable per account
  • Immediate logout option

Audit Trail​

Business plans include audit logs:

  • Who accessed what
  • When access occurred
  • What actions were taken

Access audit logs:

  1. Go to "Settings" > "Security"
  2. Click "Audit Log"
  3. Filter and search events

Best Practices​

Principle of Least Privilege​

  • Grant minimum necessary access
  • Review permissions regularly
  • Revoke unused access

Regular Reviews​

  • Audit team members monthly
  • Review API key usage
  • Check shared chatbot access

Secure Practices​

  • Enable MFA for all users
  • Use SSO where possible
  • Rotate API keys regularly