Concepts

The piecesCopy Anchor Link

Platform
├── Users (platform admin, platform auditor, or neither)
├── Model connections ──< Models (chat, embedding, moderation, SystemOne, vision)
├── Embedding profiles
├── Classification levels (Open, Sensitive, Restricted by default)
├── Platform-shared data sources
└── Teams (each approved up to a maximum classification)
    ├── Members (owner, admin, editor, member) and pending invites
    ├── API keys (personal and team service keys)
    ├── Data sources ──< Documents ──< Passages
    ├── Knowledge bases (a set of data sources)
    └── Agents ──< Published versions
          └── Conversations (readable only by the person who had them)

TeamsCopy Anchor Link

A team is the tenant. It owns its data sources, knowledge bases, agents and API keys, and it has its own members, limits, usage and audit log. Only platform admins create teams; there are no personal spaces. Someone who signs in without being on a team can still use agents that are shared with them.

Data sources and documentsCopy Anchor Link

A data source produces documents. It has exactly one type, set when it's created:

• Upload: files you upload in the app or through the API.
• Web: pages fetched by Grounded's own crawler. It can scrape one page, fetch a list of pages, crawl a site or map one.

Each source also has one embedding profile and one classification level. A document is one parsed page or file, split into passages (chunks) that are embedded and indexed for search. Platform admins can also create platform-shared sources that any team may attach to its knowledge bases.

Knowledge basesCopy Anchor Link

A knowledge base is a named set of data sources, searched together. It can mix the team's own sources with platform-shared ones. All its sources share one embedding profile. Search is hybrid: a vector search and a keyword search run side by side and their results are fused. Each knowledge base has default retrieval settings, such as how many passages a search returns.

AgentsCopy Anchor Link

An agent answers questions from one or more knowledge bases (up to five). It has instructions, a chat model and settings for how it searches, answers and cites. You edit a draft; publishing creates an immutable, numbered version, and people always chat with the latest published version.

By default an agent is strictly grounded: it answers only from its sources, answers the part of a question its sources cover and says what they don't, and gives the team's refusal message when they have nothing relevant.

AudiencesCopy Anchor Link

Each published agent has one audience:

ConversationsCopy Anchor Link

A conversation is private to the person who had it. Other team members, team admins and platform admins can't read it. The one exception is a platform admin in an audited, time-limited break-glass session with the conversations scope. People can export their own conversations (Markdown or JSON) and delete them. Teams see only aggregates and metadata, never message content.

Classification levelsCopy Anchor Link

Classification levels describe how sensitive data is. A default install has three:

Platform admins can change the levels and write what each one means for their organisation. Grounded enforces the rules when anything changes and again on every question:

• A team is approved up to a maximum level, and its sources can't be classified above it.
• A knowledge base is as sensitive as its most sensitive source, and an agent as its most sensitive knowledge base.
• Each model has a maximum level. An embedding model can't embed, and a chat model can't read, data above its level.
• An agent's audience must be allowed for its level.

What each level covers, and which data is not allowed at all, is your organisation's policy. Grounded provides the mechanisms; it doesn't encode any law.

Embedding profiles and modelsCopy Anchor Link

Platform admins connect Grounded to one or more OpenAI-compatible model connections and add models from them. An embedding profile fixes the embedding model, the vector dimensions, the query and document prefixes and the passage sizes. A profile can't change in place: moving a knowledge base to a new one is a background profile migration.

RolesCopy Anchor Link

Team rolesCopy Anchor Link

Only platform admins change a team's limits or approved classification. In the app, a role's badge (on Members, and "Your role" on the team Overview) opens what that role can and can't do.

Platform rolesCopy Anchor Link

Platform roles don't grant any access to team content. The last active platform admin can't be demoted or suspended.