Concepts
Roles, groups, sharing, tools and models – how LOKI decides who can see and do what.
This page explains the terms that come up again and again in the chat and the dashboard. Once you understand how groups and sharing work together, you can answer almost any question like “Why doesn't LOKI find this document?” yourself.
Roles
Every user account has one of three roles. The role follows from the account's settings and the groups it belongs to.
| Role | How you get it | What it can do |
|---|---|---|
| User | Default for every account | Use the chat. The dashboard is locked. |
| Manager | Listed as Manager in at least one group | Use the chat. In the dashboard, upload, share and delete the documents of their own groups and view the overview. |
| Administrator | Administrator is ticked in the account | The entire dashboard: users, groups, tools, sources, models, compliance and updates. |
Administrators don't chat
Administrator accounts are intended for administration. In the chat they get no tools and therefore no access to documents; anyone who opens the chat is redirected to the dashboard. If you, as an administrator, also want to use LOKI yourself, you need a second account without administrator rights.
Groups
Groups bring together people who should see the same documents and use the same tools, for example “Sales” or “Human Resources”. LOKI has two kinds:
- LOKI groups are created by administrators in the dashboard, where they also manage the members.
- Microsoft groups are imported regularly from Microsoft Entra ID if your organisation has connected Microsoft 365. Their members are managed in Microsoft, not in LOKI. In the dashboard you can only assign tools to these groups.
In a LOKI group, each person is either a Member or a Manager:
- Members see the group's documents and use its tools.
- Managers can additionally manage the group's documents in the dashboard. This makes them managers.
A person can be in several groups. They then see everything that at least one of their groups sees, and use all the tools that at least one of their groups has.
Sharing: who finds which document
Every document is shared with one or more groups. In the chat, a person finds only documents that are shared with at least one of their groups. All other documents do not exist for them: LOKI does not cite them and does not mention them.
Where the sharing comes from depends on how the document got into LOKI:
| Origin | Who decides the sharing |
|---|---|
| Uploaded in the dashboard | The person uploading chooses the groups. They can be changed later in the dashboard. |
| Watched folder | The groups entered for the folder apply to every file in it. |
| SharePoint | LOKI reads the permissions from SharePoint. Anyone allowed to open a file in SharePoint also finds it in LOKI. If a permission cannot be assigned unambiguously, LOKI is stricter than SharePoint, never more generous. |
Sharing alone is not enough
For a person to be able to search documents in the chat, one of their groups also needs the Document search tool (for SharePoint: SharePoint search). Without this tool they find no documents, not even shared ones.
Tools
Tools are the capabilities LOKI may use for a person in the chat. Each tool is available only to the groups an administrator has assigned it to. There is no tool that automatically applies to everyone.
| Tool | What LOKI does with it |
|---|---|
| Document search | Searches the shared documents from uploads and watched folders. |
| SharePoint search | Searches files from SharePoint that the person has access to. |
| Outlook e-mail | Reads and searches the person's own Outlook mailbox, read-only. |
| Web search and Fetch web page | Searches the internet and reads public web pages. |
| Run Python | Does calculations and creates charts. Runs isolated without network access. |
| Long-term memory | Remembers facts and preferences across chats. |
In addition, administrators can share individual Databases with groups. LOKI then only reads from them and changes nothing.
Each person can switch off tools they have for themselves (see Data sources and tools). They cannot add any.
Local model and cloud models
The answers in the chat are written by an AI language model. LOKI comes with its own model that runs on the LOKI appliance and is called Loki in the chat. It is always available and has no usage limit.
Administrators can additionally connect models from cloud providers such as Anthropic, OpenAI, Google or Mistral. If someone selects such a model in the chat, the following applies:
- The chat clearly shows “Cloud model active” with the note that messages and uploaded documents are sent to an external provider.
- Every request to a cloud model is logged in the dashboard.
- Administrators can set usage limits per provider. When a limit is reached, the chat automatically switches to the local model.
- Compliance policies can detect confidential details such as names or IBANs before sending and redact them, block them or ask for confirmation (see Compliance).
What leaves the LOKI appliance
As a rule, LOKI processes your documents and questions on the appliance: text recognition, search, answers from the local model, voice input and calculations. Data leaves the device only in these cases:
| When | What |
|---|---|
| A cloud model is selected | The chat's messages and the content LOKI draws on for them go to the provider. |
| Web search is used | Search terms go to public search engines; LOKI fetches public web pages. |
| Microsoft 365 is connected | LOKI fetches groups, SharePoint files and, where applicable, emails from Microsoft. |
| An email is sent | LOKI sends password reset links and forwarded feedback via an external email service. |
| Updates and maintenance | The appliance downloads new versions from ignaite and is connected to ignaite for device maintenance. |
What LOKI stores
- Chats remain stored until you delete them. A deleted chat disappears from your list and cannot be restored. The messages are permanently removed from the database when the user account is deleted.
- Files you attach in the chat and screenshots from feedback are deleted by LOKI after a retention period, 90 days by default. Their name and file type remain visible.
- Memories remain until you delete them yourself (see Memories).
- Documents remain until they are deleted in the dashboard or removed at the source.