--- title: "Organization Settings, Rebuilt: Roles, Policies, Groups and Alerts" slug: "organization-management-roles-policies-groups-alerts" date: "2026-10-14" tag: "Application" summary: "ibl.ai's organization settings were rebuilt around four sidebar groups, and Management now holds eight sub-tabs — Users, Groups, Roles, Policies, Teams, Alerts, Applications and Onboarding — six of them gated by their own permission." author: "ibl.ai Engineering" repo: "iblai/vibe" linkedin: | ibl.ai's organization settings now split Management into eight sub-tabs, six of them gated by their own permission, on an access model security teams already know from cloud IAM. They are Users, Groups, Roles, Policies, Teams, Alerts, Applications and Onboarding. A role is a named bundle of permissions. A policy grants a role to users or groups on a set of resources, and resources are hierarchical: grant on all agents and it covers every one, grant on one agent and it stops there. Groups bundle people so one policy assignment covers all of them. Teams are curated sets you can share, say to let a manager view a team's analytics. Alerts pair watched users with watchers, and each watcher subscribes to its own events. The rest of the settings now sit under four headings, Workspace, Finance, AI & data and System, and a heading disappears when none of its tabs apply to you. Access control only means something if you control the system it runs on. On ibl.ai you own all the code and the data, so the roles, the policies and the groups are yours. #iblai #AgenticAI #EnterpriseAI #RBAC #AIGovernance #IAM --- **ibl.ai's rebuilt organization settings group every admin panel under Workspace, Finance, AI & data and System, and split Management into eight sub-tabs — Users, Groups, Roles, Policies, Teams, Alerts, Applications and Onboarding — six of them gated by their own permission, on a platform where you own all the code and the data.** The rebuild was documented in [`iblai/vibe`](https://github.com/iblai/vibe) on **September 25, 2026**, merged on **October 6** and released in **v2.12.0 on October 12**. Applications and Onboarding now sit in Management; the earlier docs listed six sub-tabs. The screenshots come from the ibl.ai organization settings dialog in [Agentic LMS](/product/agentic-lms). The same `` component runs in [Agentic OS](/product/agentic-os) and drops into any app built with [Agentic Vibe](/product/agentic-vibe). ## What changed in ibl.ai organization settings? Two things: the sidebar and the Management tab. The sidebar now groups its tabs under four headings — **Workspace** (Organization, Management, Integrations), **Finance** (Monetization, Billing), **AI & data** (Benchmarks, Memory and [Virtual Machine](/updates/virtual-machine-settings-policies-and-secrets)) and **System** (Advanced).

The rebuilt organization settings dialog in ibl.ai, with the sidebar grouped under Workspace (Organization, Management, Integrations), AI and data (Memory) and System (Advanced), and the Management panel showing eight sub-tabs — Users, Groups, Roles, Policies, Teams, Alerts, Applications and Onboarding — on the Roles tab, which defines an RBAC role as a named bundle of permissions, with a Search roles box, a New Role button and one role, LLM Model Access Role.

A heading disappears when every tab under it is hidden from you, so a small organization sees two or three headings, not four — the organization above has no Finance group and shows only Memory under AI & data. Below the desktop breakpoint, the sidebar turns into a scrolling strip of pills. ## How does role-based access control work in ibl.ai? Three objects do the work. A **role** is, in the screen's words, *"a named bundle of permissions (actions applied to resources in policies)."* Its **actions** take the form `Namespace/Resource/verb` and accept wildcards, and a role can also carry **data actions** that reach individual fields. A **policy** grants a role's permissions to a set of users or groups on a set of resources. Resources are hierarchical paths: a policy granted on the collection of all agents covers every agent, while one granted on a single agent's path stops at that agent. Built-in roles and policies are protected — their delete buttons are disabled with "Cannot delete internal roles" and "Cannot delete internal policies".

The Groups sub-tab of Management in ibl.ai organization settings, explaining that RBAC groups bundle users so a single policy assignment grants permissions to all of them and that the same group can be reused across policies, with a Search groups box, a New Group button and a table listing the Tenant Admins group with the unique ID tenant_admins.

A **group** bundles users so that one policy assignment covers all of them, and the same group can be reused across any number of policies. Add a person to a group once, and every policy that names the group applies to them. With RBAC on, six sub-tabs are gated by seven permissions — `can_manage_users`, `can_invite`, and list permissions on groups, roles, policies, user groups and watched groups — so a person sees only the ones they can use. Applications and Onboarding appear for anyone who can open Management, watchers excepted. ## How do you get notified about what specific users do? With **Teams** and **Alerts**. A team is *"a curated set of users that you can share with others"* — for example, to let a manager view the team's analytics, or to send notifications to it.

An alert pairs a team of **watched users** with one or more **watchers**, who are notified when monitored events occur. Each watcher subscribes to its own subset of events, so two people on the same alert can follow different things. ## How do new people join an ibl.ai organization? Through three paths on Management. **Invite**, from the Users sub-tab, invites by user, by course or by program: one email at a time, or a CSV with an `email` column and five optional ones, from `first_name` to `user_group`.

The Invite Users dialog in ibl.ai organization settings, which sends invitations to new users and manages existing invites, with Users, Courses and Programs tabs, an email field with a Send Invite button, an Upload CSV button and a Download CSV template link.

**Applications** reviews applications to the organization and edits the questions applicants answer, with Blocked Users, All Submissions and New form controls. **Onboarding** chooses the agents that greet new members, sets how each introduces itself, and gives you the link that opens it. Until an onboarding agent is picked, new members skip onboarding entirely. Selecting anyone on the Users sub-tab opens their profile read-only, including a **Usage** tab with that person's AI spend. ## Can you build these admin screens into your own app? Yes. Organization settings ship as one component, ``, from `@iblai/iblai-js/web-containers/next`, with a 280 px sidebar and keyboard navigation by arrow keys, Home and End. Pass `enableRbac` together with the caller's permissions from the platform's RBAC check endpoint, and Management, its sub-tabs and the Finance tabs (Monetization, Billing) follow them; every other tab stays admin-only. One rule the [`/iblai-vibe-account`](https://github.com/iblai/vibe/blob/main/skills/organizations/iblai-vibe-account/SKILL.md) skill states plainly: turn on `enableRbac` without passing the permissions and Management disappears, even for an admin. Pass both, or neither. Each sub-tab has its own walkthrough: [Users](/docs/os/organization-settings/users), [Groups](/docs/os/organization-settings/groups), [Roles](/docs/os/organization-settings/roles), [Policies](/docs/os/organization-settings/policies), [Teams](/docs/os/organization-settings/teams) and [Alerts](/docs/os/organization-settings/alerts). The rest of the dialog is covered in [user profile and organization settings](/updates/profile-and-organization-settings). ## Want to map your org chart onto roles and policies? Bring your access model and we'll show it as roles, policies and groups on a live tenant. [Book a 30-minute demo](https://cal.com/iblai/30min) or [talk to the ibl.ai team](/contact) — ibl.ai is family-owned and operated from New York, NY.