diff --git a/doc/docs/en/quick-start/installation.md b/doc/docs/en/quick-start/installation.md index 6f8b1acc97..911b92ccca 100644 --- a/doc/docs/en/quick-start/installation.md +++ b/doc/docs/en/quick-start/installation.md @@ -80,7 +80,7 @@ After a successful deployment, non-sensitive choices are saved to `deploy/docker 1️⃣ **When deploying v1.8.0 or later for the first time**, Nexent creates the `suadmin@nexent.com` super administrator account with the default password `Nexent@123`, without prompting, and displays it in the terminal after successful creation. Override it before the first deployment with `NEXENT_SUPER_ADMIN_PASSWORD` in `deploy/env/.env`; non-interactive creation displays the effective password. As an exception, an offline package launched with `--config` prompts for and confirms the password, and that input takes precedence without being displayed. -> This account is used for permission management only and cannot develop agents or create knowledge bases. Log in with this account and complete: Access tenant resources → Create tenant → Create tenant administrator, then log in with the tenant administrator account to use all features. For role permissions, see [User Management](../user-guide/user-management). +> This account is used for permission management only and cannot develop agents or create knowledge bases. Log in with this account and complete: Access tenant resources → Create tenant → Create tenant administrator, then log in with the tenant administrator account to use all features. For role permissions, see [User Management](../user-guide/resource-management). 2️⃣ To recreate the `suadmin` account, follow these steps: diff --git a/doc/docs/en/user-guide/user-management.md b/doc/docs/en/user-guide/resource-management.md similarity index 51% rename from doc/docs/en/user-guide/user-management.md rename to doc/docs/en/user-guide/resource-management.md index 112bae15da..34407136ed 100644 --- a/doc/docs/en/user-guide/user-management.md +++ b/doc/docs/en/user-guide/resource-management.md @@ -1,4 +1,4 @@ -# User Management +# Resource Management This page provides a detailed explanation of the Nexent platform's user role system, data visibility scope, operation permissions for various resources, and practical examples of permission configuration. @@ -37,12 +37,12 @@ Nexent adopts a Role-Based Access Control (RBAC) model, dividing user scope thro Includes the following four core roles: -| Role | Responsibility Description | Applicable Scenarios | Role Notes | -| ---- | -------------------------- | -------------------- | ---------- | -| **Super Administrator** | Can create **different tenants** and manage all tenant resources | Platform operation and maintenance personnel | There is only one Super Administrator in Nexent. It is created during the first deployment, and its password can be preset through the deployment environment | -| **Administrator** | Responsible for **intra-tenant** resource management and permission allocation | Department managers, tenant leaders | A tenant can have multiple administrators, who can only be invited by the Super Administrator | -| **Developer** | Can create and edit agents, knowledge bases, and other resources, but has no management permissions | Developers, product managers | A tenant can have multiple developers who can belong to multiple user groups within the tenant, invited by administrators and the Super Administrator | -| **Regular User** | Can only use platform features without creation and editing permissions | Employees, business personnel | A tenant can have multiple regular users who can belong to multiple user groups within the tenant, invited by administrators and the Super Administrator | +| Role | Responsibility Description | Applicable Scenarios | Role Notes | +| ----------------------- | --------------------------------------------------------------------------------------------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **Super Administrator** | Can create **different tenants** and manage all tenant resources | Platform operation and maintenance personnel | There is only one Super Administrator in Nexent. It is created during the first deployment, and its password can be preset through the deployment environment | +| **Administrator** | Responsible for **intra-tenant** resource management and permission allocation | Department managers, tenant leaders | A tenant can have multiple administrators, who can only be invited by the Super Administrator | +| **Developer** | Can create and edit agents, knowledge bases, and other resources, but has no management permissions | Developers, product managers | A tenant can have multiple developers who can belong to multiple user groups within the tenant, invited by administrators and the Super Administrator | +| **Regular User** | Can only use platform features without creation and editing permissions | Employees, business personnel | A tenant can have multiple regular users who can belong to multiple user groups within the tenant, invited by administrators and the Super Administrator | #### 1.3.1 Super Administrator @@ -77,26 +77,23 @@ Regular Users only have permission to use agents for conversations. - ✅ Can view their own usage records and personal information - ❌ Cannot create or edit agents, knowledge bases - - ## II. Tab Access Permissions -| Tab | Super Administrator | Administrator | Developer | Regular User | -| --- | :-----------------: | :-----------: | :-------: | :----------: | -| **Home** | ✅ | ✅ | ✅ | ✅ | -| **Start Chat** | ❌ | ✅ | ✅ | ✅ | -| **Quick Setup** | ❌ | ✅ | ✅ | ✅ | -| **Agent Space** | ❌ | ✅ | ✅ | ❌ | -| **Agent Market** | ❌ | ✅ | ✅ | ❌ | -| **Agent Development** | ❌ | ✅ | ✅ | ❌ | -| **Knowledge Base** | ❌ | ✅ | ✅ | ❌ | -| **MCP Tools** | ❌ | ✅ | ✅ | ❌ | -| **Monitoring** | ✅ | ✅ | ✅ | ❌ | -| **Model Management** | ❌ | ✅ | ✅ | ❌ | -| **Memory Management** | ❌ | ✅ | ✅ | ✅ | -| **Personal Information** | ❌ | ✅ | ✅ | ✅ | -| **Tenant Resources** | ✅ | ✅ | ❌ | ❌ | - +| Tab | Super Administrator | Administrator | Developer | Regular User | +| ------------------------ | :-----------------: | :-----------: | :-------: | :----------: | +| **Home** | ✅ | ✅ | ✅ | ✅ | +| **Start Chat** | ❌ | ✅ | ✅ | ✅ | +| **Quick Setup** | ❌ | ✅ | ✅ | ✅ | +| **Agent Space** | ❌ | ✅ | ✅ | ❌ | +| **Agent Market** | ❌ | ✅ | ✅ | ❌ | +| **Agent Development** | ❌ | ✅ | ✅ | ❌ | +| **Knowledge Base** | ❌ | ✅ | ✅ | ❌ | +| **MCP Tools** | ❌ | ✅ | ✅ | ❌ | +| **Monitoring** | ✅ | ✅ | ✅ | ❌ | +| **Model Management** | ❌ | ✅ | ✅ | ❌ | +| **Memory Management** | ❌ | ✅ | ✅ | ✅ | +| **Personal Information** | ❌ | ✅ | ✅ | ✅ | +| **Tenant Resources** | ✅ | ✅ | ❌ | ❌ | ## III. Resource Permission Comparison @@ -107,94 +104,93 @@ The following tables show the operation permissions of four roles for various ty ### 3.1 User and User Group Permissions -| Operation | Super Administrator | Administrator | Developer | Regular User | -| --------- | :-----------------: | :-----------: | :-------: | :----------: | -| **View Tenant List** | ✅ | ❌ | ❌ | ❌ | -| **Create/Delete Tenant** | ✅ | ❌ | ❌ | ❌ | -| **View User List** | ✅ | ✅ | ❌ | ❌ | -| **Edit User Permissions** | ✅ | ✅ | ❌ | ❌ | -| **Delete User** | ✅ | ✅ | ❌ | ❌ | -| **Assign User Group** | ✅ | ✅ | ❌ | ❌ | -| **View User Group List** | ✅ | ✅ | ❌ | ❌ | -| **Create User Group** | ✅ | ✅ | ❌ | ❌ | -| **Edit User Group** | ✅ | ✅ | ❌ | ❌ | -| **Delete User Group** | ✅ | ✅ | ❌ | ❌ | +| Operation | Super Administrator | Administrator | Developer | Regular User | +| ------------------------- | :-----------------: | :-----------: | :-------: | :----------: | +| **View Tenant List** | ✅ | ❌ | ❌ | ❌ | +| **Create/Delete Tenant** | ✅ | ❌ | ❌ | ❌ | +| **View User List** | ✅ | ✅ | ❌ | ❌ | +| **Edit User Permissions** | ✅ | ✅ | ❌ | ❌ | +| **Delete User** | ✅ | ✅ | ❌ | ❌ | +| **Assign User Group** | ✅ | ✅ | ❌ | ❌ | +| **View User Group List** | ✅ | ✅ | ❌ | ❌ | +| **Create User Group** | ✅ | ✅ | ❌ | ❌ | +| **Edit User Group** | ✅ | ✅ | ❌ | ❌ | +| **Delete User Group** | ✅ | ✅ | ❌ | ❌ | ### 3.2 Model Permissions -| Operation | Super Administrator | Administrator | Developer | Regular User | -| --------- | :-----------------: | :-----------: | :-------: | :----------: | -| **View Model List** | ✅ | ✅ | ✅ | ❌ | -| **Add Model** | ✅ | ✅ | ❌ | ❌ | -| **Edit Model** | ✅ | ✅ | ❌ | ❌ | -| **Delete Model** | ✅ | ✅ | ❌ | ❌ | -| **Test Connectivity** | ✅ | ✅ | ✅ | ❌ | -| **Use Model** | ❌ | ✅ | ✅ | ✅ | +| Operation | Super Administrator | Administrator | Developer | Regular User | +| --------------------- | :-----------------: | :-----------: | :-------: | :----------: | +| **View Model List** | ✅ | ✅ | ✅ | ❌ | +| **Add Model** | ✅ | ✅ | ❌ | ❌ | +| **Edit Model** | ✅ | ✅ | ❌ | ❌ | +| **Delete Model** | ✅ | ✅ | ❌ | ❌ | +| **Test Connectivity** | ✅ | ✅ | ✅ | ❌ | +| **Use Model** | ❌ | ✅ | ✅ | ✅ | > 💡 **Note**: Models are tenant-level shared resources. All user groups within the same tenant share the same model pool, with no group-level isolation. Administrators uniformly manage model configurations, while developers and regular users can only use configured models. ### 3.3 Knowledge Base Permissions -| Operation | Super Administrator | Administrator | Developer | Regular User | -| --------- | :-----------------: | :-----------: | :-------: | :----------: | -| **View Knowledge Base List** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | -| **View Knowledge Base Details** | ❌ | ✅ | 🟡 Self-created/Authorized | ❌ | -| **View Knowledge Base Summary** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | -| **Create Knowledge Base** | ❌ | ✅ | ✅ | ❌ | -| **Edit Knowledge Base Name and Permissions** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | -| **Edit Knowledge Base Chunks and Summary** | ❌ | ✅ | 🟡 Self-created/Authorized | ❌ | -| **Delete Knowledge Base** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | -| **Upload/Delete Files** | ❌ | ✅ | 🟡 Self-created/Authorized | ❌ | +| Operation | Super Administrator | Administrator | Developer | Regular User | +| -------------------------------------------- | :-----------------: | :-----------: | :------------------------: | :----------: | +| **View Knowledge Base List** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | +| **View Knowledge Base Details** | ❌ | ✅ | 🟡 Self-created/Authorized | ❌ | +| **View Knowledge Base Summary** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | +| **Create Knowledge Base** | ❌ | ✅ | ✅ | ❌ | +| **Edit Knowledge Base Name and Permissions** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | +| **Edit Knowledge Base Chunks and Summary** | ❌ | ✅ | 🟡 Self-created/Authorized | ❌ | +| **Delete Knowledge Base** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | +| **Upload/Delete Files** | ❌ | ✅ | 🟡 Self-created/Authorized | ❌ | ### 3.4 Agent Permissions -| Operation | Super Administrator | Administrator | Developer | Regular User | -| --------- | :-----------------: | :-----------: | :-------: | :----------: | -| **View Agent List** | ✅ | ✅ | 🟡 Self-created/Authorized | 🟡 Authorized Published Agents | -| **View Agent Info** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | -| **Edit Agent Config** | ❌ | ✅ | 🟡 Self-created/Authorized | ❌ | -| **Manage Agent Versions** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | -| **Delete Agent** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | -| **Use Agent Chat** | ❌ | ✅ | 🟡 Self-created/Authorized | 🟡 Authorized Published Agents | +| Operation | Super Administrator | Administrator | Developer | Regular User | +| ------------------------- | :-----------------: | :-----------: | :------------------------: | :----------------------------: | +| **View Agent List** | ✅ | ✅ | 🟡 Self-created/Authorized | 🟡 Authorized Published Agents | +| **View Agent Info** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | +| **Edit Agent Config** | ❌ | ✅ | 🟡 Self-created/Authorized | ❌ | +| **Manage Agent Versions** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | +| **Delete Agent** | ✅ | ✅ | 🟡 Self-created/Authorized | ❌ | +| **Use Agent Chat** | ❌ | ✅ | 🟡 Self-created/Authorized | 🟡 Authorized Published Agents | ### 3.5 MCP Permissions -| Operation | Super Administrator | Administrator | Developer | Regular User | -| --------- | :-----------------: | :-----------: | :-------: | :----------: | -| **View MCP Tools** | ✅ | ✅ | ✅ | ❌ | -| **Edit MCP Tools** | ✅ | ✅ | ❌ | ❌ | -| **Add MCP Tools** | ✅ | ✅ | ✅ | ❌ | -| **Delete MCP Tools** | ✅ | ✅ | ❌ | ❌ | +| Operation | Super Administrator | Administrator | Developer | Regular User | +| -------------------- | :-----------------: | :-----------: | :-------: | :----------: | +| **View MCP Tools** | ✅ | ✅ | ✅ | ❌ | +| **Edit MCP Tools** | ✅ | ✅ | ❌ | ❌ | +| **Add MCP Tools** | ✅ | ✅ | ✅ | ❌ | +| **Delete MCP Tools** | ✅ | ✅ | ❌ | ❌ | > 💡 **Note**: MCP tools are tenant-level shared resources. All user groups within the same tenant share the same MCP tools, with no group-level isolation. Administrators can add and manage MCP tools, while developers can only add MCP tools. - ## IV. Permission Configuration ### 4.1 Agent Permission Settings -| Permission Level | Description | Applicable Scenario | -| ---------------- | ----------- | ------------------- | -| **Creator Only** | Only the creator (and administrators) can view and edit | Personal development agents | -| **Specified User Group - Read Only** | User groups specified in the agent development page can view and publish, but cannot edit or delete. | Department-specific agents | +| Permission Level | Description | Applicable Scenario | +| ------------------------------------ | ---------------------------------------------------------------------------------------------------- | --------------------------- | +| **Creator Only** | Only the creator (and administrators) can view and edit | Personal development agents | +| **Specified User Group - Read Only** | User groups specified in the agent development page can view and publish, but cannot edit or delete. | Department-specific agents | +
Agent Permission Settings
### 4.2 Knowledge Base Permission Settings -| Permission Level | Description | Applicable Scenario | -| ---------------- | ----------- | ------------------- | -| **Private** | Only the creator (and administrators) can view and manage | Personal knowledge base | -| **Specified User Group - Read Only** | Specified user groups can view but cannot edit or delete | Department knowledge base | -| **Specified User Group - Editable** | Specified user groups can view and edit, delete | Project team knowledge base | +| Permission Level | Description | Applicable Scenario | +| ------------------------------------ | --------------------------------------------------------- | --------------------------- | +| **Private** | Only the creator (and administrators) can view and manage | Personal knowledge base | +| **Specified User Group - Read Only** | Specified user groups can view but cannot edit or delete | Department knowledge base | +| **Specified User Group - Editable** | Specified user groups can view and edit, delete | Project team knowledge base |
Knowledge Base Permission Settings 1 Knowledge Base Permission Settings 2
- ## V. Invitation Code Mechanism Nexent platform uses an invitation code mechanism to control new user registration, ensuring platform security and controllability. @@ -213,7 +209,6 @@ Nexent platform uses an invitation code mechanism to control new user registrati Invitation Code 2 - ## VI. Practical Examples This section uses **XX City People's Hospital - Orthopedics Department** as an example to demonstrate how to build a single-department medical intelligent assistant system on the Nexent platform, as well as the workflow of each role in the system. @@ -224,21 +219,21 @@ This section uses **XX City People's Hospital - Orthopedics Department** as an e In the scenario of XX City People's Hospital, the correspondence between Nexent platform levels and hospital entities is as follows: -| Level | Corresponding Entity | Description | -| ----- | -------------------- | ----------- | -| **Super Administrator** | Hospital Information Center/System Administrator | Manages multiple departments (multiple tenants) of the entire hospital | -| **Single Tenant** | Single Department | Such as: Orthopedics, Cardiology, Surgery | -| **User Groups within Tenant** | Professional groups within the department | Such as: Orthopedics Physician Group, Nursing Group, Rehabilitation Group | -| **Members within User Groups** | Specific medical staff/patients | Such as: Chief Physician of Orthopedics, Charge Nurse, Inpatient | +| Level | Corresponding Entity | Description | +| ------------------------------ | ------------------------------------------------ | ------------------------------------------------------------------------- | +| **Super Administrator** | Hospital Information Center/System Administrator | Manages multiple departments (multiple tenants) of the entire hospital | +| **Single Tenant** | Single Department | Such as: Orthopedics, Cardiology, Surgery | +| **User Groups within Tenant** | Professional groups within the department | Such as: Orthopedics Physician Group, Nursing Group, Rehabilitation Group | +| **Members within User Groups** | Specific medical staff/patients | Such as: Chief Physician of Orthopedics, Charge Nurse, Inpatient | #### 6.1.2 Definition and Responsibilities of Each Role -| Role | Corresponding Personnel in Orthopedics Tenant | Core Responsibilities | Data Visibility Scope | -| ---- | --------------------------------------------- | --------------------- | --------------------- | -| **Super Administrator** | Hospital Information Center Administrator | Manages multiple tenants of hospital departments (Orthopedics, Cardiology, Surgery, etc.) | Data of all tenants in the hospital | -| **Administrator** | Chief of Orthopedics | Manages all resources within the Orthopedics tenant (users, agents, knowledge bases, etc.) | All data of this department (this tenant) | -| **Developer** | Chief Physicians and Associate Chief Physicians of Orthopedics Sub-specialties | Creates and edits clinical auxiliary agents, uploads professional materials to knowledge bases | Resources authorized within this department; self-created resources are manageable | -| **Regular User** | Resident Physicians, Nurses, Patients | Uses published agents for work assistance, information queries, health education | Resources authorized for use within this department; view-only, no editing | +| Role | Corresponding Personnel in Orthopedics Tenant | Core Responsibilities | Data Visibility Scope | +| ----------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | +| **Super Administrator** | Hospital Information Center Administrator | Manages multiple tenants of hospital departments (Orthopedics, Cardiology, Surgery, etc.) | Data of all tenants in the hospital | +| **Administrator** | Chief of Orthopedics | Manages all resources within the Orthopedics tenant (users, agents, knowledge bases, etc.) | All data of this department (this tenant) | +| **Developer** | Chief Physicians and Associate Chief Physicians of Orthopedics Sub-specialties | Creates and edits clinical auxiliary agents, uploads professional materials to knowledge bases | Resources authorized within this department; self-created resources are manageable | +| **Regular User** | Resident Physicians, Nurses, Patients | Uses published agents for work assistance, information queries, health education | Resources authorized for use within this department; view-only, no editing | ### 6.2 Example User Work Scenarios @@ -320,7 +315,6 @@ In the scenario of XX City People's Hospital, the correspondence between Nexent - ❌ Doctor's diagnostic system (no permission) - ❌ Other patients' data (completely isolated) - ## 💡 Get Help If you encounter any issues while using the platform: diff --git a/doc/docs/zh/quick-start/installation.md b/doc/docs/zh/quick-start/installation.md index 824b352957..085fcb6f70 100644 --- a/doc/docs/zh/quick-start/installation.md +++ b/doc/docs/zh/quick-start/installation.md @@ -80,7 +80,7 @@ bash deploy.sh docker --image-source local-latest #### ⚠️ 重要提示 1️⃣ **首次部署 v1.8.0 及以上版本时**，系统会创建 `suadmin@nexent.com` 超级管理员账号，默认密码为 `Nexent@123`，无需交互输入，创建成功后会在终端显示。可在首次部署前通过 `deploy/env/.env` 中的 `NEXENT_SUPER_ADMIN_PASSWORD` 覆盖默认值，非交互创建时终端会显示实际使用的密码。使用离线部署包并显式指定 `--config` 时例外：部署脚本会要求输入并确认密码，并以本次输入为准；手动输入的密码不会在终端显示。 -> 该账号仅用于权限管理，无权开发智能体或创建知识库。请登录该账号，依次完成：访问租户资源→创建租户→创建租户管理员，然后使用租户管理员账号登录,即可使用全部功能。角色权限详情参见 [用户管理](../user-guide/user-management) +> 该账号仅用于权限管理，无权开发智能体或创建知识库。请登录该账号，依次完成：访问租户资源→创建租户→创建租户管理员，然后使用租户管理员账号登录,即可使用全部功能。角色权限详情参见 [用户管理](../user-guide/resource-management) 2️⃣ 如需重建 `suadmin` 账号，请按照以下步骤操作： ```bash diff --git a/doc/docs/zh/user-guide/user-management.md b/doc/docs/zh/user-guide/resource-management.md similarity index 76% rename from doc/docs/zh/user-guide/user-management.md rename to doc/docs/zh/user-guide/resource-management.md index fabcf50df3..5e6b8c5ada 100644 --- a/doc/docs/zh/user-guide/user-management.md +++ b/doc/docs/zh/user-guide/resource-management.md @@ -1,4 +1,4 @@ -# 用户管理 +# 资源管理 本页面详细说明 Nexent 平台的用户角色体系、数据可见性范围、各类资源的操作权限，并分享权限配置的实践案例。 @@ -37,11 +37,11 @@ Nexent 采用基于角色的访问控制（RBAC）模型，通过租户与用户 包含以下四个核心角色： -| 角色 | 职责描述 | 适用场景 | 角色备注 | -| -------------- | ---------------------------------------------- | -------------------- | ------------------------------------------------------------ | -| **超级管理员** | 可创建**不同租户**，管理所有租户资源 | 平台运维人员 | Nexent 系统只有一个超级管理员，首次部署默认创建，可通过部署环境变量预设密码 | -| **管理员** | 负责**租户内**的资源管理和权限分配 | 部门经理、租户负责人 | 同一租户可拥有多个管理员，只能由超级管理员邀请 | -| **开发者** | 可创建和编辑智能体、知识库等资源，但无管理权限 | 开发人员、产品经理 | 同一租户下可拥有多个开发者，可属于租户下多个用户组，由管理员和超级管理员邀请 | +| 角色 | 职责描述 | 适用场景 | 角色备注 | +| -------------- | ---------------------------------------------- | -------------------- | ------------------------------------------------------------------------------ | +| **超级管理员** | 可创建**不同租户**，管理所有租户资源 | 平台运维人员 | Nexent 系统只有一个超级管理员，首次部署默认创建，可通过部署环境变量预设密码 | +| **管理员** | 负责**租户内**的资源管理和权限分配 | 部门经理、租户负责人 | 同一租户可拥有多个管理员，只能由超级管理员邀请 | +| **开发者** | 可创建和编辑智能体、知识库等资源，但无管理权限 | 开发人员、产品经理 | 同一租户下可拥有多个开发者，可属于租户下多个用户组，由管理员和超级管理员邀请 | | **普通用户** | 仅可使用平台提供的各项功能，无创建和编辑权限 | 员工、业务人员 | 同一租户下可拥有多个普通用户，可属于租户下多个用户组，由管理员和超级管理员邀请 | #### 1.3.1 超级管理员 @@ -77,25 +77,23 @@ Nexent 采用基于角色的访问控制（RBAC）模型，通过租户与用户 - ✅ 可以查看自己的使用记录和个人信息 - ❌ 不能创建或编辑智能体、知识库 - ## 二、页签访问权限 | 页签 | 超级管理员 | 管理员 | 开发者 | 普通用户 | | -------------- | :--------: | :----: | :----: | :------: | -| **首页** | ✅ | ✅ | ✅ | ✅ | -| **开始问答** | ❌ | ✅ | ✅ | ✅ | -| **快速配置** | ❌ | ✅ | ✅ | ✅ | -| **智能体空间** | ❌ | ✅ | ✅ | ❌ | -| **智能体市场** | ❌ | ✅ | ✅ | ❌ | -| **智能体开发** | ❌ | ✅ | ✅ | ❌ | -| **知识库** | ❌ | ✅ | ✅ | ❌ | -| **MCP工具** | ❌ | ✅ | ✅ | ❌ | -| **监控与运维** | ✅ | ✅ | ✅ | ❌ | -| **模型管理** | ❌ | ✅ | ✅ | ❌ | -| **记忆管理** | ❌ | ✅ | ✅ | ✅ | -| **个人信息** | ❌ | ✅ | ✅ | ✅ | -| **租户资源** | ✅ | ✅ | ❌ | ❌ | - +| **首页** | ✅ | ✅ | ✅ | ✅ | +| **开始问答** | ❌ | ✅ | ✅ | ✅ | +| **快速配置** | ❌ | ✅ | ✅ | ✅ | +| **智能体空间** | ❌ | ✅ | ✅ | ❌ | +| **智能体市场** | ❌ | ✅ | ✅ | ❌ | +| **智能体开发** | ❌ | ✅ | ✅ | ❌ | +| **知识库** | ❌ | ✅ | ✅ | ❌ | +| **MCP工具** | ❌ | ✅ | ✅ | ❌ | +| **监控与运维** | ✅ | ✅ | ✅ | ❌ | +| **模型管理** | ❌ | ✅ | ✅ | ❌ | +| **记忆管理** | ❌ | ✅ | ✅ | ✅ | +| **个人信息** | ❌ | ✅ | ✅ | ✅ | +| **租户资源** | ✅ | ✅ | ❌ | ❌ | ## 三、资源权限对照表 @@ -108,73 +106,72 @@ Nexent 采用基于角色的访问控制（RBAC）模型，通过租户与用户 | 操作 | 超级管理员 | 管理员 | 开发者 | 普通用户 | | ------------------ | :--------: | :----: | :----: | :------: | -| **查看租户列表** | ✅ | ❌ | ❌ | ❌ | -| **创建/删除租户** | ✅ | ❌ | ❌ | ❌ | -| **查看用户列表** | ✅ | ✅ | ❌ | ❌ | -| **编辑用户权限** | ✅ | ✅ | ❌ | ❌ | -| **删除用户** | ✅ | ✅ | ❌ | ❌ | -| **分配用户组** | ✅ | ✅ | ❌ | ❌ | -| **查看用户组列表** | ✅ | ✅ | ❌ | ❌ | -| **创建用户组** | ✅ | ✅ | ❌ | ❌ | -| **编辑用户组** | ✅ | ✅ | ❌ | ❌ | -| **删除用户组** | ✅ | ✅ | ❌ | ❌ | +| **查看租户列表** | ✅ | ❌ | ❌ | ❌ | +| **创建/删除租户** | ✅ | ❌ | ❌ | ❌ | +| **查看用户列表** | ✅ | ✅ | ❌ | ❌ | +| **编辑用户权限** | ✅ | ✅ | ❌ | ❌ | +| **删除用户** | ✅ | ✅ | ❌ | ❌ | +| **分配用户组** | ✅ | ✅ | ❌ | ❌ | +| **查看用户组列表** | ✅ | ✅ | ❌ | ❌ | +| **创建用户组** | ✅ | ✅ | ❌ | ❌ | +| **编辑用户组** | ✅ | ✅ | ❌ | ❌ | +| **删除用户组** | ✅ | ✅ | ❌ | ❌ | ### 3.2 模型权限 | 操作 | 超级管理员 | 管理员 | 开发者 | 普通用户 | | ---------------- | :--------: | :----: | :----: | :------: | -| **查看模型列表** | ✅ | ✅ | ✅ | ❌ | -| **添加模型** | ✅ | ✅ | ❌ | ❌ | -| **编辑模型** | ✅ | ✅ | ❌ | ❌ | -| **删除模型** | ✅ | ✅ | ❌ | ❌ | -| **测试连通性** | ✅ | ✅ | ✅ | ❌ | -| **使用模型** | ❌ | ✅ | ✅ | ✅ | +| **查看模型列表** | ✅ | ✅ | ✅ | ❌ | +| **添加模型** | ✅ | ✅ | ❌ | ❌ | +| **编辑模型** | ✅ | ✅ | ❌ | ❌ | +| **删除模型** | ✅ | ✅ | ❌ | ❌ | +| **测试连通性** | ✅ | ✅ | ✅ | ❌ | +| **使用模型** | ❌ | ✅ | ✅ | ✅ | > 💡 **说明**：模型为租户级共享资源，同租户内所有用户组共享相同的模型池，不存在组间隔离。管理员统一管理模型配置，开发者和普通用户仅能使用已配置的模型。 ### 3.3 知识库权限 -| 操作 | 超级管理员 | 管理员 | 开发者 | 普通用户 | -| ------------------------ | :--------: | :----: | :---------------: | :------: | -| **查看知识库列表** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | -| **查看知识库详情** | ❌ | ✅ | 🟡 自己创建/被授权 | ❌ | -| **查看知识库总结** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | -| **创建知识库** | ❌ | ✅ | ✅ | ❌ | -| **编辑知识库名称和权限** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | -| **编辑知识库分块、总结** | ❌ | ✅ | 🟡 自己创建/被授权 | ❌ | -| **删除知识库** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | -| **上传/删除文件** | ❌ | ✅ | 🟡 自己创建/被授权 | ❌ | +| 操作 | 超级管理员 | 管理员 | 开发者 | 普通用户 | +| ------------------------ | :--------: | :----: | :----------------: | :------: | +| **查看知识库列表** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | +| **查看知识库详情** | ❌ | ✅ | 🟡 自己创建/被授权 | ❌ | +| **查看知识库总结** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | +| **创建知识库** | ❌ | ✅ | ✅ | ❌ | +| **编辑知识库名称和权限** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | +| **编辑知识库分块、总结** | ❌ | ✅ | 🟡 自己创建/被授权 | ❌ | +| **删除知识库** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | +| **上传/删除文件** | ❌ | ✅ | 🟡 自己创建/被授权 | ❌ | ### 3.4 智能体权限 -| 操作 | 超级管理员 | 管理员 | 开发者 | 普通用户 | -| ------------------ | :--------: | :----: | :---------------: | :--------------------: | -| **查看智能体列表** | ✅ | ✅ | 🟡 自己创建/被授权 | 🟡 被授权的已发布智能体 | -| **查看智能体信息** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | -| **编辑智能体配置** | ❌ | ✅ | 🟡 自己创建/被授权 | ❌ | -| **管理智能体版本** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | -| **删除智能体** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | -| **使用智能体对话** | ❌ | ✅ | 🟡 自己创建/被授权 | 🟡 被授权的已发布智能体 | +| 操作 | 超级管理员 | 管理员 | 开发者 | 普通用户 | +| ------------------ | :--------: | :----: | :----------------: | :---------------------: | +| **查看智能体列表** | ✅ | ✅ | 🟡 自己创建/被授权 | 🟡 被授权的已发布智能体 | +| **查看智能体信息** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | +| **编辑智能体配置** | ❌ | ✅ | 🟡 自己创建/被授权 | ❌ | +| **管理智能体版本** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | +| **删除智能体** | ✅ | ✅ | 🟡 自己创建/被授权 | ❌ | +| **使用智能体对话** | ❌ | ✅ | 🟡 自己创建/被授权 | 🟡 被授权的已发布智能体 | ### 3.5 MCP权限 | 操作 | 超级管理员 | 管理员 | 开发者 | 普通用户 | | --------------- | :--------: | :----: | :----: | :------: | -| **查看MCP工具** | ✅ | ✅ | ✅ | ❌ | -| **编辑MCP工具** | ✅ | ✅ | ❌ | ❌ | -| **添加MCP工具** | ✅ | ✅ | ✅ | ❌ | -| **删除MCP工具** | ✅ | ✅ | ❌ | ❌ | +| **查看MCP工具** | ✅ | ✅ | ✅ | ❌ | +| **编辑MCP工具** | ✅ | ✅ | ❌ | ❌ | +| **添加MCP工具** | ✅ | ✅ | ✅ | ❌ | +| **删除MCP工具** | ✅ | ✅ | ❌ | ❌ | > 💡 **说明**：MCP 工具为租户级共享资源，同租户内所有用户组共享相同的 MCP 工具，不存在组间隔离。管理员可添加和管理 MCP 工具，开发者仅能添加 MCP 工具。 - ## 四、权限配置 ### 4.1 智能体权限设置 -| 权限级别 | 说明 | 适用场景 | -| ------------------- | ------------------------------------------------------------ | ---------------- | -| **仅创建者可见** | 只有创建者（和管理员）可以查看和编辑 | 个人开发的智能体 | +| 权限级别 | 说明 | 适用场景 | +| ------------------- | ------------------------------------------------------------------------------ | ---------------- | +| **仅创建者可见** | 只有创建者（和管理员）可以查看和编辑 | 个人开发的智能体 | | **指定用户组-只读** | 智能体开发页面指定用户组，则用户组内开发者可见、可发布，但不可编辑、不可删除。 | 部门专用智能体 | 智能体权限设置 @@ -192,7 +189,6 @@ Nexent 采用基于角色的访问控制（RBAC）模型，通过租户与用户 知识库权限设置2 - ## 五、邀请码机制 Nexent 平台采用邀请码机制控制新用户注册，确保平台的安全性和可控性。 @@ -209,7 +205,6 @@ Nexent 平台采用邀请码机制控制新用户注册，确保平台的安全 邀请码2 - ## 六、实践案例 本节以**XX市人民医院-骨科**为例，展示如何在 Nexent 平台中构建单科室的医疗智能助手系统，以及各角色在系统中的工作流程。