https://litefuse.ai/_next/static/chunks/pages/en/administration/rbac-6258381f5ba1c2a6.js

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[88313],{1735:(e,a,s)=>{(window.__NEXT_P=window.__NEXT_P||[]).push(["/en/administration/rbac",function(){return s(51601)}])},51601:(e,a,s)=>{"use strict";s.r(a),s.d(a,{RolePermissionTable:()=>d,default:()=>p,useTOC:()=>c});var r=s(23798),n=s(20711),t=s(28262),o=s(24540),i=s(85742),l=s(59100);function d(e){let{roleScopes:a}=e,s={div:"div",...(0,o.R)()};return(0,r.jsx)(s.div,{className:"grid grid-cols-5 gap-1",children:Object.entries(a).map(e=>{let[a,n]=e;return(0,r.jsxs)(s.div,{className:"flex flex-col",children:[(0,r.jsx)(s.div,{className:"border-b pb-2 mb-2 border-gray-600",children:a}),n.sort((e,a)=>e.localeCompare(a)).map(e=>(0,r.jsx)(s.div,{className:"text-xs mt-1 break-words",children:e},e))]},a)})})}function c(e){return[{value:"Access Organizations and Projects",id:"access-organizations-and-projects",depth:2},{value:"Roles and Scopes",id:"roles-and-scopes",depth:2},{value:"Managing users",id:"managing-users",depth:2},{value:"Add a new user to an organization",id:"add-a-new-user-to-an-organization",depth:3},{value:"Changing user roles",id:"changing-user-roles",depth:3},{value:"Managing Projects",id:"managing-projects",depth:2},{value:"Add a new project",id:"add-a-new-project",depth:3},{value:"Transfer a project to another organization",id:"transfer-a-project-to-another-organization",depth:3},{value:"Project-level roles",id:"project-level-roles",depth:2},{value:"Related Resources",id:"related-resources",depth:2}]}let p=(0,n.e)(function(e){let{toc:a=c(e)}=e,s={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",p:"p",ul:"ul",...(0,o.R)(),...e.components},{AvailabilityBanner:n}=s;return n||function(e,a){throw Error("Expected "+(a?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("AvailabilityBanner",!0),(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.h1,{children:"Role-Based Access Controls in Litefuse"}),"\n",(0,r.jsx)(s.p,{children:"The role-based access control (RBAC) in Litefuse is based on users, organizations, projects, and roles:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"Users"})," are ",(0,r.jsx)(s.a,{href:"/administration/authentication-and-sso",children:"authenticated"})," individuals who access Litefuse"]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"Organizations"})," are the top-level entities that contain projects."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"Projects"})," group all Litefuse data to allow for fine-grained role-based access control (RBAC)."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"Roles"})," define the permissions of users within an organization and project:","\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"By default, users get assigned a role on the organizational level."}),"\n",(0,r.jsx)(s.li,{children:"For more fine-grained control, users can be assigned project-roles. This is useful when you want to differentiate permissions for different projects within the same organization."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.p,{children:[(0,r.jsx)(s.code,{children:"API Keys"})," are used to authenticate with the Litefuse API. They are associated with a project and can be used to access the project’s data programmatically. API keys are not tied to a user."]}),"\n",(0,r.jsx)(i.K,{chart:'graph LR\\n  A["User (via UI)"] --\x3e|role| B[Organization]\\n  B --\x3e|1:n| C[Projects]\\n  A -.->|optional: project-role| C\\n  D[API Keys] --\x3e|n:1| C'}),"\n",(0,r.jsx)(s.h2,{id:a[0].id,children:a[0].value}),"\n",(0,r.jsx)(s.p,{children:"You can easily switch between organizations and projects using the dropdowns in the top navigation bar."}),"\n",(0,r.jsx)(s.h2,{id:a[1].id,children:a[1].value}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"Owner"}),": has all permissions"]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"Admin"}),": can edit the project settings and grant access to other users"]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"Member"}),": can view all metrics & create scores, but cannot configure the project"]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"Viewer"}),": view-only access to the project and organization, most of the configuration is hidden"]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"None"}),": no default access to the organization, to be used when user should have access to a single project only"]}),"\n"]}),"\n","\n","\n",(0,r.jsxs)(l.nD,{type:"single",collapsible:!0,children:[(0,r.jsxs)(l.As,{value:"organization-scopes",children:[(0,r.jsx)(l.$m,{children:"Organization-level scopes"}),(0,r.jsx)(l.ub,{className:"overflow-x-auto",children:(0,r.jsx)(d,{roleScopes:{OWNER:["projects:create","projects:transfer_org","organization:CRUD_apiKeys","organization:update","organization:delete","organizationMembers:CUD","organizationMembers:read","langfuseCloudBilling:CRUD"],ADMIN:["projects:create","projects:transfer_org","organization:CRUD_apiKeys","organization:update","organizationMembers:CUD","organizationMembers:read"],MEMBER:["organizationMembers:read"],VIEWER:[],NONE:[]}})})]}),(0,r.jsxs)(l.As,{value:"project-scopes",children:[(0,r.jsx)(l.$m,{children:"Project-level scopes"}),(0,r.jsx)(l.ub,{className:"overflow-x-auto",children:(0,r.jsx)(d,{roleScopes:{OWNER:["project:read","project:update","project:delete","projectMembers:read","projectMembers:CUD","apiKeys:read","apiKeys:CUD","integrations:CRUD","objects:publish","objects:bookmark","objects:tag","traces:delete","scores:CUD","scoreConfigs:CUD","scoreConfigs:read","datasets:CUD","prompts:CUD","prompts:read","promptProtectedLabels:CUD","models:CUD","evalTemplate:CUD","evalTemplate:read","evalJob:CUD","evalJob:read","evalJobExecution:read","evalDefaultModel:CUD","evalDefaultModel:read","llmApiKeys:read","llmApiKeys:create","llmApiKeys:update","llmApiKeys:delete","llmSchemas:CUD","llmSchemas:read","llmTools:CUD","llmTools:read","batchExports:create","batchExports:read","comments:CUD","comments:read","annotationQueues:read","annotationQueues:CUD","annotationQueueAssignments:read","annotationQueueAssignments:CUD","promptExperiments:CUD","promptExperiments:read","auditLogs:read","dashboards:read","dashboards:CUD","TableViewPresets:CUD","TableViewPresets:read","automations:CUD","automations:read"],ADMIN:["project:read","project:update","projectMembers:read","projectMembers:CUD","apiKeys:read","apiKeys:CUD","integrations:CRUD","objects:publish","objects:bookmark","objects:tag","traces:delete","scores:CUD","scoreConfigs:CUD","scoreConfigs:read","datasets:CUD","prompts:CUD","prompts:read","promptProtectedLabels:CUD","models:CUD","evalTemplate:CUD","evalTemplate:read","evalJob:CUD","evalJob:read","evalJobExecution:read","evalDefaultModel:CUD","evalDefaultModel:read","llmApiKeys:read","llmApiKeys:create","llmApiKeys:update","llmApiKeys:delete","llmSchemas:CUD","llmSchemas:read","llmTools:CUD","llmTools:read","batchExports:create","batchExports:read","comments:CUD","comments:read","annotationQueues:read","annotationQueues:CUD","annotationQueueAssignments:read","annotationQueueAssignments:CUD","promptExperiments:CUD","promptExperiments:read","auditLogs:read","dashboards:read","dashboards:CUD","TableViewPresets:CUD","TableViewPresets:read","automations:CUD","automations:read"],MEMBER:["project:read","projectMembers:read","apiKeys:read","objects:publish","objects:bookmark","objects:tag","scores:CUD","scoreConfigs:CUD","scoreConfigs:read","datasets:CUD","prompts:CUD","prompts:read","evalTemplate:CUD","evalTemplate:read","evalJob:read","evalJob:CUD","evalJobExecution:read","evalDefaultModel:read","evalDefaultModel:CUD","llmApiKeys:read","llmSchemas:read","llmTools:read","batchExports:create","batchExports:read","comments:CUD","comments:read","annotationQueues:read","annotationQueues:CUD","annotationQueueAssignments:read","promptExperiments:CUD","promptExperiments:read","dashboards:read","dashboards:CUD","TableViewPresets:CUD","TableViewPresets:read","automations:read"],VIEWER:["project:read","prompts:read","evalTemplate:read","scoreConfigs:read","evalJob:read","evalJobExecution:read","evalDefaultModel:read","llmApiKeys:read","llmSchemas:read","llmTools:read","comments:read","annotationQueues:read","promptExperiments:read","dashboards:read","TableViewPresets:read","automations:read"],NONE:[]}})})]})]}),"\n",(0,r.jsx)(s.h2,{id:a[2].id,children:a[2].value}),"\n",(0,r.jsx)(s.h3,{id:a[3].id,children:a[3].value}),"\n",(0,r.jsx)(s.p,{children:"In the organization settings, you can add users via their email address and assign them a role. They will receive an email notification and will be able to access the organization once they log in. Users who do not have a Litefuse account yet, will be listed as pending invites until they sign up."}),"\n",(0,r.jsx)(s.h3,{id:a[4].id,children:a[4].value}),"\n",(0,r.jsxs)(s.p,{children:["Any user with the ",(0,r.jsx)(s.code,{children:"members:CUD"})," permission can change the role of a user in the organization settings. This will affect the user’s permissions across all projects in the organization. Users can only assign roles that are lower or equal to their own role."]}),"\n",(0,r.jsx)(s.h2,{id:a[5].id,children:a[5].value}),"\n",(0,r.jsx)(s.h3,{id:a[6].id,children:a[6].value}),"\n",(0,r.jsxs)(s.p,{children:["Any user with the ",(0,r.jsx)(s.code,{children:"projects:create"})," permission can create a new project within a Litefuse organization."]}),"\n",(0,r.jsx)(s.h3,{id:a[7].id,children:a[7].value}),"\n",(0,r.jsxs)(s.p,{children:["Only users with the ",(0,r.jsx)(s.code,{children:"projects:transfer_organization"})," permission can transfer a project to another organization. This will remove the project from the current organization and add it to the new one. Access to the project will depend on the roles configured in the new organization."]}),"\n",(0,r.jsx)(s.p,{children:"During this process, no data will be lost, all project settings, data, and configurations will be transferred to the new organization. The project remains fully operational as API keys, settings (except for access management), and data will remain unchanged and associated with the project. All features (e.g. tracing, prompt management) will continue to work without any interruption."}),"\n",(0,r.jsx)(s.h2,{id:a[8].id,children:a[8].value}),"\n",(0,r.jsx)(n,{availability:{hobby:"not-available",core:"not-available",pro:"team-add-on",enterprise:"full",selfHosted:"ee"}}),"\n",(0,r.jsx)(s.p,{children:"Users by default inherit the role of the organization they are part of. For more fine-grained control, you can assign a user a role on the project level. This is useful when you want to differentiate permissions for different projects within the same organization."}),"\n",(0,r.jsx)(s.p,{children:"If a project-level role is assigned, it will override the organization-level role for that project."}),"\n",(0,r.jsxs)(s.p,{children:["If you want to give a user access to only certain projects within an organization, you can set their role to ",(0,r.jsx)(s.code,{children:"None"})," on the organization level and then assign them a role on the project level."]}),"\n",(0,r.jsx)(s.h2,{id:a[9].id,children:a[9].value}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.a,{href:"/administration/scim-and-org-api",children:"SCIM & Organization API"})," to programmatically manage users, roles, projects, and API keys"]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.a,{href:"/faq/all/managing-different-environments",children:"How to structure projects and environments"})," for production, staging, and development"]}),"\n"]})]})},"/en/administration/rbac",{filePath:"pages/en/administration/rbac.mdx",timestamp:178297317e4,pageMap:t.O,frontMatter:{description:"Litefuse offers extensive RBAC capabilities to manage project sharing and permissions across different organizations and projects.",sidebarTitle:"Access Control (RBAC)"},title:"Role-Based Access Controls in Litefuse"},"undefined"==typeof RemoteContent?c:RemoteContent.useTOC)},59100:(e,a,s)=>{"use strict";s.d(a,{$m:()=>c,As:()=>d,nD:()=>l,ub:()=>p});var r=s(23798),n=s(21462),t=s(97136),o=s(92376),i=s(13857);let l=t.bL,d=n.forwardRef((e,a)=>{let{className:s,...n}=e;return(0,r.jsx)(t.q7,{ref:a,className:(0,i.cn)("border-b",s),value:n.value,...n})});d.displayName="AccordionItem";let c=n.forwardRef((e,a)=>{let{className:s,children:n,...l}=e;return(0,r.jsx)(t.Y9,{className:"flex",children:(0,r.jsxs)(t.l9,{ref:a,className:(0,i.cn)("flex flex-1 items-center justify-between py-4 font-medium transition-all hover:underline [&[data-state=open]>svg]:rotate-180",s),...l,children:[n,(0,r.jsx)(o.A,{className:"h-4 w-4 shrink-0 transition-transform duration-200"})]})})});c.displayName=t.l9.displayName;let p=n.forwardRef((e,a)=>{let{className:s,children:n,...o}=e;return(0,r.jsx)(t.UC,{ref:a,className:(0,i.cn)("overflow-hidden transition-all data-[state=closed]:animate-accordion-up data-[state=open]:animate-accordion-down bg-card border rounded-t border-b-0 text-sm",s),...o,children:(0,r.jsx)("div",{className:"p-4",children:n})})});p.displayName=t.UC.displayName}},e=>{var a=a=>e(e.s=a);e.O(0,[45524,28262,90636,46593,38792],()=>a(1735)),_N_E=e.O()}]);