Managing Permissions

This guide explains how to manage application permissions for users in Synthreo’s Canopy portal. Permissions control which Synthreo applications a user can access, and the role they hold inside each one.

---

Understanding Permissions

Each user can be granted access to one or more Synthreo applications:

Permission	What It Grants
ThreoAI	The AI chat interface, Experts, Agents, and Projects
Builder	The ThreoBuilder agent canvas, node configuration, and testing
Canopy	The admin console for user and customer management
Pylon	The Pylon workspace: DAGs and autonomous agents. A separate application from Builder, with its own permission row and roles - granting one does not grant the other

Note

ThreoAI is created automatically and cannot be managed by hand. Every user gets a ThreoAI account when their account is created, so ThreoAI is not offered in the Application Type list, and a ThreoAI row in the permissions table carries no Edit or Delete action. Builder, Canopy, and Pylon are the permissions you grant and remove.

Role catalogs are per-application and are not interchangeable. See Roles & Permissions for each application’s current list.

---

The user detail page

Permissions are managed on the user’s own detail page, not inline in the list. Select the user’s row in User Management to open it - the whole row is the link; there is no expand arrow and no menu button.

The detail page is organized into cards:

• Account Details - First Name and Last Name (editable, with a Save Changes button), plus read-only Created, Last Access, MFA Method, and User ID.
• Security - Reset MFA (only when the user has a second factor enrolled), Send Password Reset, Disable Login (not shown on your own page), Update Email (a confirmation-link flow), and Resend Invitation (only while the user is still Pending).
• Access & Permissions - the user’s application permissions, as a table with an Add Permission button.
• Danger Zone - Remove User, which deletes the account and all its permissions.

The status badge beside the user’s name reads Active, Pending, Guest, or Disabled.

---

Viewing a User’s Permissions

Parent Tenant Users

1. Go to https://canopy.synthreo.ai
2. Select User Management in the left sidebar
3. Locate the user in the list
4. Select their row to open the user detail page
5. Read the Access & Permissions card

Child Customer Users

1. Select Customers in the left sidebar
2. Select the customer’s row to open their detail page
3. Go to the Users tab
4. Select the user’s row to open the user detail page, then read the Access & Permissions card

What the table shows

Each permission is one row, with these columns:

Column	What it shows
ID	A reference identifier: the application account’s id, and the user’s own id on a Canopy row
Last Access	When the user last used that application, or “Never”
Created At	When the permission was created
Role	The role the user holds in that application
Account	The application account the permission points at
Application	Which application the permission is for
Region	The region the application account lives in

Note

The Application column shows stored application names, not the current product names. Builder appears as ThreoBuilder and Canopy appears as Tenant management. The rename never reached those database values, so that is what Canopy renders.

With no rows, the table reads “No permissions found for this user.”

---

Adding a Permission

1. Navigate to the user (parent tenant or child customer - see above)
2. In the Access & Permissions card, select Add Permission
3. In the Add Permission dialog, fill in the four required fields in order - each one narrows the next:
   • Application Type - Builder, Canopy, or Pylon. ThreoAI is not listed
   • Region - the regions that application runs in
   • Account - the application account to attach the user to
   • Role - the roles available for that application and account
4. Leave Instance Active checked unless you want to create the permission in an inactive state
5. Select Create

If you left Instance Active checked, the user picks up the new application on their next sign-in.

If you unchecked it, the permission is created inactive and the user does not get the application. There is no way to activate it afterwards from the edit dialog - Instance Active is only offered while creating - so the way back is to delete that permission row and create it again with the box ticked.

Note

The four fields cascade. Changing Application Type clears Region, Account, and Role; changing Region clears Account and Role. That is expected - work down the dialog in order.

---

Changing a User’s Role

1. Navigate to the user’s Access & Permissions card
2. Select the pencil (Edit permission) icon on the row you want to change
3. Choose the new Role
4. Select Update

Caution

Editing a permission changes only the role. In the Edit Permission dialog, Application Type, Region, and Account are locked, and the Instance Active checkbox is not shown. To point a user at a different account or region, delete the permission and add a new one.

The role change takes effect on the user’s next sign-in or page refresh.

---

Removing a Permission

Note

ThreoAI cannot be removed - its row has no delete action. You can remove Builder, Canopy, or Pylon. To cut off a user’s access entirely, use Disable Login or Remove User on their detail page.

1. Navigate to the user’s Access & Permissions card
2. Select the trash (Delete permission) icon on the row you want to remove
3. Confirm in the Delete Permission dialog, which warns that the action cannot be undone

Caution

Removing a user’s last permission does not delete their account. The user still exists but cannot access the application until a permission is re-granted.

---

Disabling a User’s Sign-In

Removing permissions is not the way to lock someone out quickly. On the user’s detail page, the Security card carries a Login control:

• Disable Login signs the user out everywhere immediately and blocks them from signing in. Their account, data, and permissions are preserved, and the badge on their row changes to Disabled.
• Enable Login restores access.

Note

The Login control is not shown on your own user page - Canopy does not let you disable your own sign-in.

---

Sending a Password Reset

If a user cannot sign in, trigger a password reset from their detail page:

1. Open the user’s detail page (for a child-customer user, open the customer’s detail page and use the Users tab)
2. In the Security card, under Password, select Send Password Reset

Canopy emails the user a link to set a new password. For a locked-out second factor, see Resetting MFA for a User.

---

Permission Inheritance

Permissions are scoped to the account they are granted against:

• A permission granted at the parent tenant level applies to the parent tenant only
• A permission granted at a child customer level applies to that child customer only
• Permissions do not automatically cascade from parent to child tenants

---

Troubleshooting

Issue	Cause	Fix
Add Permission does nothing useful - the Role list is empty	Application Type, Region, and Account must be chosen first, in that order	Work down the dialog; Role only populates once an Account is selected
A permission row has no Edit or Delete icon	It is the ThreoAI row, which is created automatically and is not editable	Nothing to fix; use Disable Login or Remove User to cut off access
The Application column says “Tenant management”	That is Canopy’s stored application name	Nothing to fix; Tenant management is Canopy and ThreoBuilder is Builder
Permission change not reflected for the user	The user is still signed in with a cached session	Ask the user to sign out and back in
The role you want is not in the dropdown	Role catalogs differ per application	Check Roles & Permissions for that application’s list

---

FAQs

Can I grant Builder permission to a user without granting ThreoAI? No. Every user gets a ThreoAI account when their account is created, and there is no control that removes it. Builder, Canopy, and Pylon are granted on top of it.

What role should I assign when granting build-and-test access? In Pylon, that is the Builder role. In legacy ThreoBuilder, it is Full Power User (FPU). Neither manages team members or billing. See Roles & Permissions.

Does the user need to do anything after permissions are changed? Yes. They should sign out and back in. Changes to an already-open session may not take effect until the next sign-in.

Can I grant Canopy access to a child-customer user? Yes. Open the child customer, open the user’s detail page, and add a Canopy permission with the role you want. They can then administer their own tenant.

---

Related Guides

• Adding a New User - create user accounts
• Roles & Permissions - the role catalog for each application
• Platform Administration & Permissions - what each application does