Skip to main content
An organisation is MITHUNAI’s unit of isolation: everything you create belongs to one, and nothing crosses between them. Within an organisation, every person and every API key holds exactly one role, and that role decides what they may do. The four roles and their permissions are in the table below.

​
Organisations

An organisation is the unit of isolation in MITHUNAI. Your assistants, knowledge, conversations, API keys, widget embeds and branding all belong to one organisation, and nothing crosses between organisations. Isolation is enforced on every request, from the identity that made it. It never depends on a value the client sends. A resource that belongs to another organisation is reported as not found rather than forbidden, so nobody can discover what exists elsewhere by guessing identifiers. Organisations are provisioned by your MITHUNAI administrator. There is no self-service sign-up.

​
Roles

Every person and every API key holds one role in the organisation. The role decides what they can do. Two rules apply to everyone:
  • Nobody can grant a role above their own. An Administrator cannot create an Owner API key.
  • Changes take effect immediately. Membership and permissions are checked on every request, so a removed member or a revoked API key is refused on its very next request.
The MITHUNAI console does not manage members yet. To add a person to your organisation or change their role, contact your MITHUNAI representative.
Grant the narrowest role that does the job. Most integrations that only ask questions need Member. An ingestion pipeline needs Knowledge operator.

​
People and machines

MITHUNAI recognises three kinds of caller. All three go through the same authorisation checks. A widget visitor can only start a conversation with the one assistant the embed names, ask questions in it, and read their own conversation back. They cannot read your knowledge, your settings or anyone else’s conversation.

​
Administration boundaries

Your organisation’s Owners and Administrators control everything inside the organisation that the console and API expose: assistants, knowledge, API keys, widget embeds, analytics and branding. Platform-level concerns, such as creating organisations and configuring model providers, are handled by whoever operates your MITHUNAI deployment. MITHUNAI’s own support staff are outside this entirely, and reach nothing until you let them: see Control what MITHUNAI support can see. How isolation is enforced on each request, rather than merely intended, is in Security.
Last modified on September 26, 2026