docs(resource-groups): document role-based resource group creation setting

[Muhammadsaeed707]

Summary

• Added bullet to enterprise-resource-groups.md noting that admins can configure which member roles are allowed to create resource groups
• Updated security-resource-groups.md to clarify that non-admin members may also create resource groups depending on org settings
• Added new "Who can create resource groups" section documenting the available options and behavior for non-admin creators

---

Note

Low Risk
Low risk: documentation-only updates that clarify who can create Resource Groups and the implications for non-admin creators.

Overview
Clarifies Resource Groups docs to note that orgs can configure which member roles are allowed to create new groups.

Adds a new “Who can create resource groups” section describing the available role-threshold options and the behavior for non-admin creators (auto-added as group admin, with API requiring an initial admin).

^{Reviewed by Cursor Bugbot for commit 715029e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[Copilot]

Pull request overview

Updates Hub security/enterprise documentation to clarify governance and behavior around organization security controls—especially who can create Resource Groups (based on org settings) and how token management policies affect member tokens.

Changes:

• Documented configurable “minimum member role required to create resource groups” and behavior for non-admin creators.
• Expanded token management documentation to include member-facing behavior for pending/denied/revoked tokens and related policy effects; added cross-links between token docs.
• Fixed/updated an Enterprise feature table link target for the token revocation section.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
docs/hub/security-resource-groups.md	Adds “Who can create resource groups” section and clarifies that non-admin creation can be enabled by org settings.
docs/hub/enterprise-resource-groups.md	Adds a bullet noting role-based configuration for who can create resource groups.
docs/hub/security-tokens.md	Adds member-facing documentation for token management policies (approval/deny/revoke/fine-grained-only behavior).
docs/hub/enterprise-tokens-management.md	Adds cross-link to member experience docs and expands policy/deny vs revoke explanations and UI behavior notes.
docs/hub/enterprise.md	Updates the token-revocation table link fragment to the current section anchor.

Comments suppressed due to low confidence (2)

docs/hub/security-resource-groups.md:63

• Add a blank line between “The available options are:” and the list to match the surrounding markdown style in this doc and avoid list-rendering edge cases in stricter markdown processors.

This is useful for Resource Groups that should be accessible to your entire organization without requiring manual membership management.

### Enabling auto-join

**Via the UI**: Open the Resource Group's settings page and check the **Include all org members** option, then select the role to assign.

docs/hub/security-resource-groups.md:65

• The doc states additional requirements “when creating a resource group via the API”, but the linked “Programmatic User Access Control Management” guide only documents listing groups and adding users (not group creation). Either link to the resource-group creation endpoint docs (if available) or rephrase/remove this API-specific requirement so readers aren’t left without a reference.

**Via the API**: See [Configure auto-join via API](./programmatic-user-access-control#configure-auto-join-via-api).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Pierrci]

When creating a resource group via the API, non-admin creators must include at least one admin in the group's initial user list.

only via the API?