Users, permissions, and multi-tenancy

Every dataset belongs to an owner, and every operation on it is checked against a grant: a principal (user, role, or tenant) holding a permission (read, write, delete, share) on a dataset. With access control on (the default), each user+dataset pair also gets its own graph and vector databases.

Use it

Act as a user in the SDK

Without user=, SDK calls run as the default user (default_user@example.com, or DEFAULT_USER_EMAIL). To act as someone else, create or load them and pass user=:

import cognee
from cognee.modules.users.methods import create_user, get_user

alice = await create_user("alice@example.com", "password")
bob = await create_user("bob@example.com", "password")

res = await cognee.remember("Alice's notes", dataset_name="alice_notes", user=alice)
await cognee.recall("What are the notes about?", user=alice, datasets=["alice_notes"])

remember, recall, search, forget, improve and the dataset helpers all take user=.

Share a dataset

The caller must hold share on the dataset. Share by dataset id:

from uuid import UUID

from cognee.modules.users.permissions.methods import (
    authorized_give_permission_on_datasets,
    authorized_revoke_permission_on_datasets,
)

await authorized_give_permission_on_datasets(
    bob.id,  # principal: a user, role, or tenant id
    [UUID(res.dataset_id)],  # dataset ids (RememberResult.dataset_id is a str)
    "read",  # "read" | "write" | "delete" | "share"
    alice.id,  # the owner making the grant
)

await cognee.recall("...", user=bob, dataset_ids=[UUID(res.dataset_id)])  # by id (must be a UUID)

Bob must address Alice's dataset by id: dataset names resolve only among the caller's own datasets.

Tenants and roles (organizations and groups)