Groups & AI Models

Groups

Administrators only.

Settings → Groups

Groups make it possible to organize users and assign permissions in bundles. Instead of configuring access rights for each user individually, you assign them to a group, and all members automatically receive the same rights.

Typical use cases:

• Marketing team: access to the marketing knowledge base and marketing tools
• Sales: access to product information and CRM integration
• Management: access to all knowledge bases

Group overview

The table shows all groups with:

• Name: clickable to open the detail page
• Description: purpose of the group
• Members: number of members
• Created on: date of creation

Create group

1. Click “Create group”
2. Enter a name (required, max. 100 characters), e.g. “Marketing team”
3. Optionally add a description (max. 500 characters)
4. Click “Create”

You are automatically redirected to the detail page of the new group, where you can add members.

Edit group

Click a group in the overview to open the detail page.

Group details

• Change name
• Change description

Click “Save” to apply the changes.

Manage members

Add member:

1. Open the picker for adding members in the “Members” area
2. The list shows the people in your workspace right away. You only need to type if you want to narrow it down
3. Select the user, they are added to the group immediately

Remove member:

Click the remove button next to the member’s name.

System groups

Some groups are labeled as a System group. They automatically contain all members of the workspace and cannot be edited or deleted.

You recognize system groups by the “System group” label in the actions column. They are not clickable.

Note: The system group “Alle Mitglieder” is particularly useful if you want to grant a knowledge base or a tool access to all users without adding each one individually.

Permissions

A group controls not only access to knowledge bases and tools, but also what its members are allowed to do, for example create agents, connect integrations, connect data sources or manage billing. You grant these permissions per group rather than assigning them to individual users.

Open a group and scroll to the “Permissions” area. There you find all grantable rights, grouped by area:

• Agents – create and share agents
• Knowledge – create knowledge bases
• Integrations – “Create integrations”: from templates, as your own MCP server or in the chat when the AI connects an interface. This right replaces the former rights “Connect a template integration” and “Connect an MCP server”
• Skills – create and upload your own skills and connect them to third-party systems
• Data sources – connect OneDrive, SharePoint, mailbox (Microsoft 365) and file server, from the Business license on
• Models & costs – which price tiers the group may pick in chat, and whether it can use the AI credit
• Web search – whether the group may search the internet from chat and from agents
• Menu – whether members with a Pro license see the features of the Business license in the menu, marked with a lock
• Administration – manage billing, view usage analytics, and manage or merely view the AI models

On top of that there is the Apps category with the “Create apps” right: build your own apps in the chat and keep developing them. By default all members have it.

Each right has a toggle, and the change is saved immediately. Permissions add up across all of a user’s groups: whoever is in several groups receives the sum of all rights.

Default rights and the system group

Most rights are active for everyone by default, because they are granted through the system group “Alle Mitglieder”. If a right is already available to a regular group through it, 9brains shows the note “✓ Already granted to all users”. You don’t need to do anything there.

If you want to remove a default right from everyone, open the system group “Alle Mitglieder” and switch the right off there. Because this affects every user, 9brains asks for confirmation first.

Delegating rights to a specific group

Some rights are not granted by default and are initially reserved for administrators, for example “Manage billing” and “View usage analytics”. You can delegate them to a specific group without giving its members full administrator rights.

Example: giving the accounting team access to billing

1. Create a group, e.g. “Accounting”
2. Add your colleagues from accounting as members
3. In the “Permissions” area, open the Administration category and enable “Manage billing”

The group’s members now see Settings → Billing and can manage invoices, subscription and payment details, all without being an administrator. In the same way, “View usage analytics” delegates access to the usage statistics, for example to a controlling team.

Example: putting the AI models in the team’s hands

“Manage AI models” works the same way: the group’s members see Settings → AI models and decide there which models the workspace may use, which default models apply and how strict the data protection mode is. This is particularly useful when a partner administers the workspace but the choice of models should stay with the customer.

For simply looking the models up there is “View AI models”, and every member holds this right by default. The page then looks exactly the same, but every setting is locked and a note at the top explains why. Everyone can check for themselves how strong and how fast a model is, where it runs and how it handles data protection. At first the page only shows the models you can pick yourself. Models that are switched off in the workspace, or whose price tier your groups do not grant, appear via the “Enabled only” switch and are shown as switched off. If the overview should stay with administrators, switch the right off in the system group “Alle Mitglieder”.

Note: Administrators automatically hold all rights. The Models & costs and Web search categories are the exception: those rights apply to administrators themselves as well, so that a cost limit and a data-protection commitment really cover everyone. Some rights additionally require a certain license (e.g. Business): if it is not present in the workspace, the right stays visible but is greyed out and marked with a license note.

Blocking expensive models for individual groups

Every AI model carries a cost category from € to €€€€. In the Models & costs category you decide per group which of the three more expensive tiers its members may select in chat:

• Balanced models (€€) – a good balance of quality and consumption
• Expensive models (€€€) – use up the quota considerably faster
• Very expensive models (€€€€) – use up the quota fastest

The economical tier (€) deliberately has no switch: it is always available to everyone. That keeps every group able to work, however you set the other three.

All three tiers are released for everyone to begin with. Switch a tier off and its models disappear from the model picker in chat for the affected users. An ongoing chat that was running on a blocked model switches to an allowed one the next time it is opened.

Example: only one team may use the flagship models

1. Open the system group “Alle Mitglieder” and switch “Very expensive models (€€€€)” off there
2. Create a group, e.g. “Research”, and add the colleagues who need it
3. Enable “Very expensive models (€€€€)” in that group

Because rights add up across all of a user’s groups, that is all it takes: the “Research” group keeps the flagship models, everyone else no longer sees them.

Unlike the other permissions, this also applies to you as an administrator: take a price tier away from everyone and it is gone for you too. A cost limit that exempts the administrators of all people would defeat its own purpose. You cannot lock yourself out either, because the switch stays visible to you and you can release the tier again at any time, for yourself or for a group.

Guests from other workspaces follow your settings: an external partner or colleague working in your workspace automatically belongs to “Alle Mitglieder” there and therefore has exactly the price tiers you give that group. Conversely, your own people working in someone else’s workspace follow whatever is configured there.

Since the control works on the price tier rather than on individual model names, there is nothing to maintain when 9brains adds new models. A new model falls into its price tier automatically and follows the setting you already made.

What about agents? An agent has a fixed model, chosen by whoever built it. The lockout applies when the agent is configured: whoever pins a model or picks a quality tier can only do so with price tiers enabled for them. That covers every route, including creating an agent from the chat and duplicating someone else’s.

Agents configured earlier stay as they are when you switch a tier off later. A colleague for whom the tier is blocked then chats with that agent on an allowed model instead of running into an error. The agent keeps its own setting, and whoever has the tier keeps working with it unchanged.

Web search: what actually happens, and why we advise against switching it off

Web search in chat runs on an external search provider, by default Brave in the USA. In the Web search category you can switch it off with the “Use web search” right. Read this section before you do: the trade works out less often than it first appears.

What is actually transmitted. The search provider receives nothing but the search query the AI formulates, a few words such as “BMW X5 top speed”. No chat history goes with it, no documents, no knowledge base, no files. Fetching a page that was found then happens on our own servers in Germany.

Why that is usually uncritical. Most research is factual: technical data, market figures, legal texts, opening hours. None of that carries a personal reference, and anyone typing the same question into Google or Bing sends it to the USA just as well. A purely European search index of comparable quality does not exist. It only becomes critical when someone searches for a real person. For that case the AI is instructed to ask first: as soon as a name, a private address, a phone number or an e-mail address would end up in the query, it should say what it intends to search for and wait for your confirmation. Do not rely on this blindly: how reliably it happens depends on the model in use. The stronger models follow the rule, the small fast ones not always.

What switching it off costs. Without web search the AI can no longer look anything up or check anything. It answers from your company knowledge and the conversation alone. For everything that changes, prices, laws, products, people or dates, it is wrong more often as a result, and it invents more, because the means to verify itself is gone. For most users that is the more noticeable downside.

Our recommendation: leave web search on, unless you explicitly want it off or are subject to rules that require it.

If you do switch it off:

• For the whole workspace: open the system group “Alle Mitglieder” and switch the right off there.
• For individual departments: take the right off the system group and grant it to the groups that may keep searching.

In both cases 9brains asks first and names the consequence.

The AI is then not offered web search at all, and it cannot take a detour either: opening a search engine through the page fetch is blocked as well, so that one provider is not quietly replaced by five arbitrary ones. It tells the user plainly that web search is switched off and who can enable it again, and answers from your company knowledge, from the conversation and, where a concrete address is known, from the page fetched directly. That holds in chat, in agents and in the public chat on your website.

As with the price tiers, the restriction applies to you as an administrator too: a data-protection commitment that exempts the administrators would not be one. The switch stays visible, so you can release web search again at any time.

Who keeps working on the credit once the allowance is used up

When a user’s licence allowance is used up, their usage continues on the purchased AI credit, provided there is any. The “Use AI credit” right decides who that applies to.

Take the right away from a group and usage ends with the quota for its members: they keep working with the Standard model only, without limits, while colleagues who hold the right carry on with the credit as before. That way you reserve the credit for the people who really need it, instead of leaving it to whoever happens to chat first.

The right applies at both limits: a user’s personal quota and the shared workspace pool. So someone without it is put on the Standard model even when their own quota is still open but the workspace pool has run dry.

Trying out projects with a small circle first

In the Projects category, the right “Use projects” controls who may create projects and work in them. Like the other default rights, it is active for everyone to begin with.

If you want to try projects out in one team first, proceed as follows:

1. Open the system group “Alle Mitglieder” and switch “Use projects” off there
2. Create a group, e.g. “Project pilot”, and add the colleagues who should test it
3. Enable “Use projects” in that group

For everyone else, the entire Projects area disappears: the sidebar entry, the project overview and the project features in the chat as well. Anyone who receives the right later sees the area after the next page reload.

Delete group

1. Click “Delete” in the actions menu of the group
2. Confirm the deletion in the dialog that appears

Warning: Deleting a group cannot be undone. All permissions granted via the group are also removed.

AI models

For administrators and for groups holding the “Manage AI models” right. All other members see the page read-only by default and choose their personal models there (the “View AI models” right).

Settings → AI models

Here you define which AI models are available to users in your workspace. Disabled models can no longer be selected for chats.

At the top of the page you see: “X of Y models enabled”

Standard and Premium model

9brains recommends two models, shown at the top of the model picker in the chat:

• Standard model: for everyday work. It is preselected automatically for new chats.
• Premium model: for demanding tasks such as complex analysis, programming or long tasks with many intermediate steps.

We keep both recommendations up to date and move them to newer models as better ones come out. You can set a different model for your workspace: expand it in the catalogue and choose “Set as default model for the workspace” or “Set as Premium default model for the workspace”. Under Preset models at the top you can always go back to the 9brains recommendation. A model you set yourself stays in place even when we change our recommendation. When we do change it, an orange dot appears on the settings and on the model picker, and this page asks you once: switch to the new recommendation or keep your model. If you keep it, the notice only comes back at the next change.

The Standard and the Premium model cannot be switched off. To switch one of them off, set a different model for that tier first. If one of them cannot be used anyway, for example because our new recommendation is a model your workspace has switched off, or because the data protection mode rules it out, the same orange dot appears. This page then lets you switch the model on or set a different one.

Every model in the list carries a class, Premium or Standard. It follows the model’s performance on the intelligence index (see Model comparison), not its price. The class is only a guide: you can set any enabled model as the Standard or Premium model.

Note: Users can select a different model in each chat, as long as it is enabled. The default model only determines the preselection.

Personal models

Every member can set their own model for both tiers. It applies to that person only and changes nothing for the workspace: expand the model in the catalogue and choose “Set as my personal default model” or “Set as my personal Premium default model”. The personal Standard model is preselected in new chats, on every device, and the model picker in the chat shows the personal models instead of the workspace ones. Any model the person may pick in the chat is available. Agents keep using the workspace models.

Under Preset models, a tier with a personal model additionally shows “For you: …” and the button “Back to the workspace setting”. When the workspace’s model for that tier changes, the same orange dot appears and the tile asks: switch or keep. Anyone who does not decide within seven days is switched back to the workspace setting automatically. When a model is taken out of the offering, everyone who had chosen it personally goes back to the workspace setting as well.

Personal models depend on the “View AI models” right. Take that right away from a group and its members can no longer choose personal models, and ones they already chose no longer apply.

Models by provider

The models are grouped by provider (e.g. Anthropic, OpenAI, Google, Mistral). For each provider you see a card with all available models.

Model information

Each model shows:

• Name of the model
• Location: where the model is operated (e.g. EU, USA)
• Speed: relative response speed
• Quality: relative response quality

Cost category

Each model shows a cost category from € to €€€€ indicating how heavily it consumes the monthly quota. Very expensive models (€€€€) use up the quota fastest, economical models (€) slowest.

The cost category also lets you control per user group how expensive the models may be that its members can select. See Blocking expensive models for individual groups.

Privacy labels

Watch for the colored labels on each model:

Label	Meaning
EU-Sovereign	The model is hosted on EU-sovereign infrastructure. Full data control within the EU
GDPR	GDPR-compliant. Data is processed exclusively in the EU. No data transfer to third countries
GDPR (DPF)	GDPR-compliant via the EU-US Data Privacy Framework. Data may be processed in the US, but is legally protected
Global	Not usable in a GDPR-compliant way. No EU server location and no DPF certification

Tip: If your company places particular emphasis on data protection, only enable models with the EU-Sovereign, GDPR, or GDPR (DPF) label.

Enable and disable models

Each model has a toggle to enable or disable it. The change takes effect immediately.

• Enable: the model is available to all users in the chat
• Disable: the model disappears from the selection. Running chats that use this model are not affected

Image models

Same rights as for the AI models.

Settings → AI models

In addition to the chat models, you also manage the image models here. These are used by image generation and image editing in the chat.

For each image model the table shows a rating from blind comparisons by Artificial Analysis: on top for creating, below for editing if the model can edit images. Higher is better, and the best-rated models come first. Expand a model to see the explanation and the source as well.

Default image models

There are two default image models: one for creating and one for editing, that is when existing images are changed, for example to replace a background, remove objects or combine several images. For both, 9brains recommends a model per data privacy mode. The ones currently in use are listed at the top of the section under Preset image models.

You set a different model the same way as for chat models, in the catalogue: expand the model and choose “Set as the workspace’s image model for creating” or “Set as the workspace’s image model for editing”. Only models that can edit images are offered for editing. Under Preset image models you can go back to the 9brains recommendation. When we change our recommendation, the orange dot appears just as for chat models, and we ask once: switch or keep your model.

Personal image models

As with chat models, every member can set their own image model for creating and one for editing: “Set as my personal image model for creating” or “Set as my personal image model for editing”. It applies in all of that person’s chats, on every device. Agents keep using the workspace’s image models.

Everything else works like the personal models for the chat: the notice when the workspace setting changes, the automatic switch after seven days and the “View AI models” right. Only the model picker in the chat shows no dot for it, because no image model is picked there.

Note: Users can request a different image model in the chat, as long as it is enabled. For multi-image requests (combining several images), a compatible model is selected automatically.

Enable and disable image models

Just like the chat models, every image model has a toggle to enable or disable it. Disabled image models are not available in the chat.

For more information on using the image features, see Create & edit images.

Classification models

From the Business plan up, a section of its own for the classification models appears below the image models under Settings → AI models, with the same permissions as for the AI models. These models sort texts into fixed categories instead of answering. Chat and agents use them to sort many emails or documents at once.

As with the AI models, every row shows where the model runs and how it handles data. Clef runs in the EU, does not store requests and can be used in every data privacy mode. Decision-1 also runs in the EU and can be used in every data privacy mode, but Microsoft may store requests for a limited time to detect abuse. Jev runs in the USA and the provider may store requests, so it can only be used in the Global data privacy mode. In the EU-Only and GDPR modes Jev is locked and its toggle cannot be switched.

Like the other models, every classification model has a toggle. There is no default model here: the AI uses the first model allowed in your workspace. If you switch them all off, chat and agents can no longer classify texts.

Frequently asked questions

Can I also change my personal settings from the chat?

No. The personal settings can only be changed via the settings page. They then apply to all future chat messages.

Can other users see my personal settings?

No. Your settings (theme, form of address, tone, etc.) only apply to you personally and are not visible to others.

What happens when an administrator enforces MFA?

All users who have not yet set up MFA are prompted to do so within the defined deadline. After the deadline expires, access without MFA is no longer possible.

Can I change my own role?

No. Your role (User or Admin) can only be changed by another administrator. You cannot adjust your own role.

What happens when I remove a user?

The user loses access to the workspace. Their previous chat history and contributions to knowledge bases are preserved. Their personal accounts with integrations are deleted, unless you hand individual ones over to somebody else while removing them; company accounts stay. Details under Remove user.

Can I restore a deleted group?

No. Deleting a group is irreversible. You would have to create the group again and reassign the members.

What is the difference between role and license type?

The role (User/Admin) determines which management sections you see. The license type (Business/Pro/Knowledge Only) determines which features you can use, for example integrations and tools are only available with the Business license.

Can I disable all AI models?

At least one model must be enabled for the chat to work. If you only want to allow GDPR-compliant models, disable all models with the “Global” label.

Do my employees automatically use the default model?

The default model is only the preselection for new chats. Users can switch to any other enabled model in the model picker in the chat at any time, which then applies to that chat only, or set personal models.