Access control

Access control governs who can view, edit, and administer workspace resources. In the core workspace settings, admins manage members and seats. Enterprise workspaces can add more granular controls when teams need stronger separation across projects, sensitive production assets, and workspace-level settings. Use access control to protect workspace configuration, production prompt deployments, API keys, billing, trace data, datasets, and Improve approval workflows. Provider credentials should be limited to admins who manage runtime model access. The goal is to let the right people participate in the loop: operators can inspect evidence, reviewers can approve changes, admins can manage credentials, and production release owners can control environments.

​

What to govern

​

Permission patterns

• Keep workspace admin access limited to people who manage providers, billing, keys, or members.
• Give prompt authors access to the projects they work in.
• Give release owners deployment access for production environments.
• Give reviewers access to traces, datasets, evaluators, and Improve cycles.
• Give service integrations their own API keys instead of sharing user-owned secrets.
• Remove members quickly when access is no longer needed.

​

Review cadence

Review access:

• Before production launch.
• After team changes.
• After creating new API keys.
• After adding sensitive datasets or trace ingestion.
• Before enabling Improve approval workflows for a production prompt.
• After incidents involving data, billing, or deployment behavior.