Plexara
What you will take away from this lesson
Clients, suppliers and partners need to see some of what a team produces: the monthly report, the quote review, the reconciliation they are asked to sign off. Emailing attachments loses the thread; giving them an account on everything is out of the question.
An external persona gives each outside organization a seat in the portal with fixed walls. Its people sign in through your identity provider, open exactly what is shared with them, and talk with your team in threads you choose to share. This lesson builds one for a supplier on the demo tenant.
Learning Objectives
- 01Set up an external persona for one client organization.
- 02Explain where an external person’s account lives and how they sign in.
- 03List what an external person can and cannot do, whatever the persona’s other settings say.
- 04Keep a conversation internal on an item a client can open.
- 05Recognize the External mark in the share dialog, the user directory and the audit drawer.
Where this lesson sits
Lesson 804 read the access summary of an external persona. This lesson creates that persona and explains what it means for the people in it.
800 Series: Working with People Outside the Company
- 801Who can open whatThe Share dialog by access: people and their roles, personas as groups whose membership is read when the item is opened, guests, and the one general link an item has.
- 802Requests for accessWhat a person without access sees, how the owner approves as viewer or editor or declines from the email, the Inbox or the dialog, and the limits and expiry an administrator sets.
- 803Posting to a channelPosting an item to a Slack, Mattermost or email channel as a link share of its own, what the channel sees, who the link opens for, and removing it.
- 804Portal permissionsThe persona editor by surface, one access level per portal area, the sharing permission, the access summary, and what deleting a persona checks first.
- 805Your clients as external peopleAn external persona per client organization, accounts that live in your identity provider, and the fixed limits: only what is shared, only shared threads, no sharing, no agent.
- 806Files from outsideUploads into an external person’s own folder, the External files folder staff open, and registering a client’s monthly file as a table beside the warehouse.
- 807Capstone: a supplier’s collection, thread and monthly fileAn ACME supplier collection shared with the supplier’s persona, a shared thread beside an internal one, and the supplier’s next price sheet registered and joined into the review.
The 800 series builds on sharing within the team from lesson 303 and registers a client’s file the way the 500 series does. Every example is on the ACME demo tenant, with a fictional supplier, Blue Harbor Wholesale.
One persona per client organization
On the demo tenant, ACME works with a fictional supplier, Blue Harbor Wholesale. Its persona was created with sharing off, feedback and PDF export on, and uploads on.
An external persona for one supplier
What the agent calls. This is the exchange the agent has with Plexara on your behalf, shown for the technical reader. You ask in plain language; you never type any of it.
POST /api/v1/admin/personas
{ "name": "supplier-blue-harbor",
"display_name": "Blue Harbor Wholesale",
"roles": ["dp_supplier_blue_harbor"],
"external": true,
"allow_sharing": false,
"portal": { "assets": "shared", "resources": "shared",
"feedback": true, "download": true,
"uploads": true } }
201 supplier-blue-harbor
external true
capped_by_external knowledge, apis, scratch_tables,
prompts, automations, search, memory
effective_portal assets shared · resources shared
feedback on · PDF export on
uploads on · catalog none
tools (none)In the portal this is Admin > Personas > New persona with External people chosen as the account type. The response lists the areas External lowered, and the editor shows each locked row with the saved choice beside what applies.
One external persona per client organization keeps each client’s walls separate: sharing with Blue Harbor Wholesale reaches its people and nobody at any other supplier.
Where the accounts live
An external person is an account in your identity provider like any other, which is what lets your existing sign-in policies apply to them.
Where an external person’s account comes from
- 1
The account is created in your identity provider
The same place your staff accounts live. The person is given a role there that resolves to the external persona. On the demo tenant that role is dp_supplier_blue_harbor.
- 2
They sign in like anyone else
Through the same sign-in button, with the identity provider’s own password rules and multi-factor settings.
- 3
The directory records them on first sign-in
With the name and roles their sign-in carries. From then on the share picker shows them with the External mark.
- 4
Removing them is removing the role
Take the role away, or disable the account, in the identity provider. Nothing in the portal has to change.
The portal does not create outside accounts. An administrator can add a name and address to the directory ahead of time, so items can be shared with the person before their first sign-in, but that grants nothing and creates no way to sign in.
The fixed limits
External is not a set of defaults an administrator can loosen. It overrides the rest of the persona on every surface below.
What External fixes, whatever else the persona says
| Surface | An external person |
|---|---|
| The agent | No agent access at all: every tool is denied, search and fetch included, and the platform refuses it in code |
| What they open | Only the assets, collections and files shared with them or their persona, always as viewers, whatever the share says |
| Files | Their own folder and what is shared with them; no persona folder and no global library |
| Threads | Only shared threads; an internal thread is invisible to them in every list, count and notification |
| Sharing | None: no Share action, no API keys, no people directory, no mentions |
| Admin and endpoints | No admin page, and no endpoint that requires signing in |
| Anything added later | Reaches only a short list of portal routes; any route not on it, including one added in a later release, is refused |
What stays the persona’s choice: whether its people can leave feedback, export PDFs, read earlier versions of what they are shared, and upload files to their own folder.
Shared and internal threads
A document a client can open often needs two conversations: one with the client, and one about the client. On the demo tenant the supplier quote review carries both.
Two threads on one document
Shared
Personal Care increase: full range or selected SKUs?
- Opened by ACME on the supplier quote review and marked Shared. Everyone who can open the review sees it, people at Blue Harbor Wholesale included, and they can reply.
Internal
Cosmetics lead times look padded
- Opened on the same document and left Internal, the composer’s default. People at the supplier never see it, never get a count that includes it, and are never notified about it.
A thread an external person opens is always shared, and they cannot change it. The document’s owner, an editor or an administrator can switch a thread between Internal and Shared later, and the switch is recorded on the thread’s timeline.
Knowing who is outside
External people, end to end
A client organization is one persona, its people are accounts in your identity provider, they open what you share as viewers and talk in the threads you share, and nothing they do reaches the agent or the rest of the portal.
Key terms
Three terms cover external people.
Key Terms
- External persona
- A persona marked for people outside the organization, typically one per client. External fixes its limits whatever its other settings say.
- External person
- An account in your identity provider whose role resolves to an external persona.
- Shared thread
- A feedback thread everyone who can open the item sees, external people included. A new thread starts as internal.