Lehmus AI: Managing project users and permissions 

Permissions in Lehmus AI are project specific. A project, or tenant, allows conversations, materials, RAG configurations and other resources belonging to different projects to be kept separate. 

Project members can use the project resources they have been granted permission to access. 

Project administrators have permissions relating to project management. For example, a project administrator can create a dedicated Preset Agent for the project. 

Permissions are managed through the University of Oulu’s IDM groups. Two groups are created for each project: 

You can find step-by-step instructions for adding users to and removing them from a project on the guidance page User account groups and their maintenance, and the mailing list service – ict.oulu.fi. 

Not all permissions in Lehmus AI are determined solely by project membership. 

For example, an individual RAG may have separate Administrators and Viewers. RAG Administrators’ permissions allow users to edit, start, stop and delete the endpoint, as well as manage its data sources. Viewers’ permissions allow users to view configurations without changing them. 

A project agent, in turn, has separate Administrators and Users permissions. Users’ permissions allow users to use the agent but not manage it. 

Administrators of an external MCP server can edit or delete the server and update its credentials. Every project member can use an MCP server belonging to the project. 

Only a project administrator can create a Service account API key. These keys are intended for shared and production workloads, rather than a Personal key tied to an individual user. 

For more detailed instructions, see Lehmus AI: Creating and managing API keys. 

If you encounter problems managing project permissions, contact ict@oulu.fi or ai@oulu.fi.