52 lines
2.4 KiB
Markdown
52 lines
2.4 KiB
Markdown
## 🔒 Access
|
|
|
|
This bot employs access control to decide who can use its services and manage its configuration.
|
|
|
|
|
|
### 👋 Joining rooms
|
|
|
|
The bot automatically joins rooms only when invited by someone considered a bot [👥 user](#-users).
|
|
|
|
|
|
### 👥 Users
|
|
|
|
The bot can be used by users that match some [dynamically](./configuration/README.md#dynamic-configuration) configured [Matrix user id](https://spec.matrix.org/v1.11/#users) patterns.
|
|
|
|
Users:
|
|
|
|
- ✅ can **invite the bot to rooms**
|
|
- ✅ can **use all the bot's [features](./features.md)** ([💬 Text Generation](./features.md#-text-generation), [🦻 Speech-to-Text](./features.md#-speech-to-text), etc.) by sending room messages
|
|
- ✅ can **change the bot's configuration in a room** (e.g. `!bai config room ...` commands)
|
|
- ❌ cannot **change the bot's global configuration** (e.g. `!bai config global ...` commands)
|
|
- ❌ cannot **create new [🤖 Agents](./agents.md)** (neither in rooms, nor globally). See [💼 Room-local agent managers](#-room-local-agent-managers) for controlling which users can create agents.
|
|
|
|
The following commands are available:
|
|
- **Show** the currently allowed users: `!bai access users`
|
|
- **Set** the list of allowed users: `!bai access set-users SPACE_SEPARATED_PATTERNS`
|
|
|
|
Example patterns: `@*:example.com @*:another.com @someone:company.org`
|
|
|
|
|
|
### 👮♂️ Administrators
|
|
|
|
Administrators can **manage the bot's configuration and access control**.
|
|
|
|
Administrators are [👥 Users](#-users) and [💼 Room-local agent managers](#-room-local-agent-managers) implicitly, so they inherit all their permissions.
|
|
|
|
The bot can be administrated by users that match some [statically](./configuration/README.md#static-configuration) configured [Matrix user id](https://spec.matrix.org/v1.11/#users) patterns.
|
|
|
|
Administrators cannot be changed without adjusting the bot's configuration on the server.
|
|
|
|
|
|
### 💼 Room-local agent managers
|
|
|
|
Room-local agent managers are users privileged to **create their own [agents](./agents.md)** (see `!bai agent`) in rooms.
|
|
|
|
**⚠️ WARNING**: Letting regular users create agents which contact arbitrary network services **may be a security issue**.
|
|
|
|
The following commands are available:
|
|
- **Show** the currently allowed users: `!bai access room-local-agent-managers`
|
|
- **Set** the list of allowed users: `!bai access set-room-local-agent-managers SPACE_SEPARATED_PATTERNS`
|
|
|
|
Example patterns: `@*:example.com @*:another.com @someone:company.org`
|