# Cognee Permissions

Use when working with cognee's users, permissions, and multi-tenancy, creating users...

- Repository: https://github.com/topoteretes/cognee (32985 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add topoteretes/cognee --skill cognee-permissions -g -a claude-code -y`
Codex: `npx skills add topoteretes/cognee --skill cognee-permissions -g -a codex -y`
Cursor: `npx skills add topoteretes/cognee --skill cognee-permissions -g -a cursor -y`
Gemini CLI: `npx skills add topoteretes/cognee --skill cognee-permissions -g -a gemini-cli -y`

## Description

Use when working with cognee's users, permissions, and multi-tenancy, creating users, tenants and roles, sharing datasets (read/write/delete/share grants), acting as a specific user in the SDK or authenticating over HTTP (login, API keys), turning access control on or off, debugging PermissionDeniedError or missing datasets, or understanding where permissions are enforced and how datasets are isolated.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Users, permissions, and multi-tenancy

Every dataset belongs to an owner, and every operation on it is checked
against a **grant**: a principal (user, role, or tenant) holding a
permission (`read`, `write`, `delete`, `share`) on a dataset. With access
control on (the default), each user+dataset pair also gets its own graph and
vector databases.

## Use it

### Act as a user in the SDK

Without `user=`, SDK calls run as the default user
(`default_user@example.com`, or `DEFAULT_USER_EMAIL`). To act as someone
else, create or load them and pass `user=`:

```python
import cognee
from cognee.modules.users.methods import create_user, get_user

alice = await create_user("alice@example.com", "password")
bob = await create_user("bob@example.com", "password")

res = await cognee.remember("Alice's notes", dataset_name="alice_notes", user=alice)
await cognee.recall("What are the notes about?", user=alice, datasets=["alice_notes"])
```

`remember`, `recall`, `search`, `forget`, `improve` and the dataset helpers
all take `user=`.

### Share a dataset

The caller must hold `share` on the dataset. Share **by dataset id**:

```python
from uuid import UUID

from cognee.modules.users.permissions.methods import (
    authorized_give_permission_on_datasets,
    authorized_revoke_permission_on_datasets,
)

await authorized_give_permission_on_datasets(
    bob.id,  # principal: a user, role, or tenant id
    [UUID(res.dataset_id)],  # dataset ids (RememberResult.dataset_id is a str)
    "read",  # "read" | "write" | "delete" | "share"
    alice.id,  # the owner making the grant
)

await cognee.recall("...", user=bob, dataset_ids=[UUID(res.dataset_id)])  # by id (must be a UUID)
```

Bob must address Alice's dataset by **id**: dataset *names* resolve only
among the caller's own datasets.

### Tenants and roles (organizations and groups)

The rest: https://github.com/topoteretes/cognee/blob/HEAD/.agents/skills/cognee-permissions/SKILL.md