Roles & Permissions
Master reference of Infralo's Role-Based Access Control (RBAC) model, including global roles, workspace roles, and granular permission definitions.
Infralo uses Role-Based Access Control (RBAC) to enforce security policies. A user's capabilities are determined by a combination of their Global Role (which governs platform-wide operations) and their Workspace Role (which governs actions within a specific workspace).
Global Roles
Global Roles are assigned to users at the tenant (organization) level. They dictate a user's access to system administration, platform settings, and global registries.
| Role | Identifier | Scope | Description |
|---|---|---|---|
| Superadmin | superadmin | Tenant-wide | Full administrative access across all tenants, users, and resources in the system. |
| Admin | admin | Tenant-wide | Administrative access to manage users, global models, runtime modules, system settings, and global observability. |
| Member | member | Tenant-wide | Default role for standard users. Allows creating new workspaces and viewing basic tenant properties. |
Global Roles Permission Matrix
| Feature Area | Superadmin | Admin | Member |
|---|---|---|---|
| Tenants Administration | Full Access | Full Access | View Only |
| Users Administration | Full Access | Full Access | No Access |
| Global Models Catalog | Full Access | Full Access | No Access |
| Workspace Creation | Yes | Yes | Yes |
| Global Telemetry & Logs | Full Access | Full Access | No Access |
| Runtime Module Plugins | Full Access | Full Access | No Access |
| Audit Logs | Full Access | View Only | No Access |
| System Roles Mapping | View Only | View Only | View Only |
Workspace Roles
Workspace Roles determine what a user can do inside a specific workspace. A global user can hold different roles in different workspaces (for example, being the Owner of a development workspace but only a Member of a production workspace).
| Role | Identifier | Description |
|---|---|---|
| Owner | owner | Full control and ownership over the workspace. Only the Owner can delete the workspace or modify ownership. |
| Admin | admin | Administrative access to configure the workspace, manage members, whitelist models, create deployments, and generate API keys. |
| Member | member | Standard developer access. Allows viewing workspace settings, calling whitelisted models/deployments, and checking workspace logs. |
Workspace Roles Permission Matrix
| Feature Area | Owner | Admin | Member |
|---|---|---|---|
| Workspace Settings | Full Access | View & Update | View Only |
| Workspace Deletion | Yes | No | No |
| Workspace Members | Full Access | Manage Members | View Members |
| Workspace API Keys | Full Access | Full Access | View Only |
| Workspace Models Whitelist | Full Access | Full Access | View Only |
| Deployments (Load Balancers) | Full Access | Full Access | View Only |
| Workspace Logs & Metrics | Full Access | Full Access | Full Access |
Granular Permissions Reference
Below is the master list of all individual permissions enforced by Infralo's gateway and API services.
| Category | Permission | Code Key | Description |
|---|---|---|---|
| Tenants Administration | View Tenants | TENANT_VIEW | Allows viewing global tenants information. |
| Tenants Administration | Update Tenants | TENANT_UPDATE | Allows modifying global tenants configuration. |
| Tenants Administration | Delete Tenants | TENANT_DELETE | Allows deleting global tenants. |
| Users Administration | View Users | USER_VIEW | Allows viewing the global users registry. |
| Users Administration | Create Users | USER_CREATE | Allows inviting or creating new global users. |
| Users Administration | Update Users | USER_UPDATE | Allows editing global user details and roles. |
| Users Administration | Delete Users | USER_DELETE | Allows deleting global users. |
| Workspace Settings | Create Workspaces | WORKSPACE_CREATE | Allows creating new workspaces in the tenant. |
| Workspace Settings | View Workspaces | WORKSPACE_VIEW | Allows viewing workspace details and overview. |
| Workspace Settings | Update Workspaces | WORKSPACE_UPDATE | Allows updating workspace name, description, and gateway configurations. |
| Workspace Settings | Delete Workspaces | WORKSPACE_DELETE | Allows deleting workspaces and cleaning up their associated resources. |
| Workspace Members | View Workspace Members | WORKSPACE_USER_VIEW | Allows viewing workspace members and their roles. |
| Workspace Members | Invite Workspace Members | WORKSPACE_USER_CREATE | Allows inviting new members to the workspace. |
| Workspace Members | Update Workspace Members | WORKSPACE_USER_UPDATE | Allows updating workspace member roles. |
| Workspace Members | Remove Workspace Members | WORKSPACE_USER_DELETE | Allows removing members from the workspace. |
| Workspace API Keys | View API Keys | WORKSPACE_API_KEY_VIEW | Allows viewing workspace API keys. |
| Workspace API Keys | Create API Keys | WORKSPACE_API_KEY_CREATE | Allows creating new workspace API keys. |
| Workspace API Keys | Update API Keys | WORKSPACE_API_KEY_UPDATE | Allows editing workspace API key permissions and settings. |
| Workspace API Keys | Delete API Keys | WORKSPACE_API_KEY_DELETE | Allows deleting or revoking workspace API keys. |
| Global Models | View Global LLMs | GLOBAL_LLM_VIEW | Allows viewing the global catalog of LLMs. |
| Global Models | Create Global LLMs | GLOBAL_LLM_CREATE | Allows adding new LLMs to the global catalog. |
| Global Models | Update Global LLMs | GLOBAL_LLM_UPDATE | Allows editing global LLMs settings, providers, and limits. |
| Global Models | Delete Global LLMs | GLOBAL_LLM_DELETE | Allows deleting LLMs from the global catalog. |
| Workspace Models | View Workspace LLMs | WORKSPACE_LLM_VIEW | Allows viewing LLMs whitelisted for the workspace. |
| Workspace Models | Enable Workspace LLMs | WORKSPACE_LLM_CREATE | Allows linking global LLMs to the workspace. |
| Workspace Models | Update Workspace LLMs | WORKSPACE_LLM_UPDATE | Allows toggling workspace LLMs status. |
| Workspace Models | Disable Workspace LLMs | WORKSPACE_LLM_DELETE | Allows unlinking LLMs from the workspace. |
| Deployments | View Deployments | DEPLOYMENT_VIEW | Allows viewing workspace load-balanced deployments. |
| Deployments | Create Deployments | DEPLOYMENT_CREATE | Allows creating new deployments and load-balancer configurations. |
| Deployments | Update Deployments | DEPLOYMENT_UPDATE | Allows editing workspace load-balancer configurations and routing rules. |
| Deployments | Delete Deployments | DEPLOYMENT_DELETE | Allows deleting deployments. |
| Deployment Models | View Deployment LLMs | DEPLOYMENT_LLM_VIEW | Allows viewing LLM configurations attached to deployments. |
| Deployment Models | Add Deployment LLMs | DEPLOYMENT_LLM_CREATE | Allows attaching models to deployments. |
| Deployment Models | Update Deployment LLMs | DEPLOYMENT_LLM_UPDATE | Allows configuring weights and states for deployment models. |
| Deployment Models | Remove Deployment LLMs | DEPLOYMENT_LLM_DELETE | Allows removing models from deployments. |
| Global Observability | View Global Logs | GLOBAL_LOGS_VIEW | Allows viewing system-wide gateway request logs. |
| Global Observability | View Global Traces | GLOBAL_TRACING_VIEW | Allows viewing global traces. |
| Global Observability | View Global Metrics | GLOBAL_METRICS_VIEW | Allows viewing system-wide analytics, reliability, and cost dashboards. |
| Workspace Observability | View Workspace Logs | WORKSPACE_LOGS_VIEW | Allows viewing workspace-specific gateway request logs. |
| Workspace Observability | View Workspace Traces | WORKSPACE_TRACING_VIEW | Allows viewing workspace traces. |
| Workspace Observability | View Workspace Metrics | WORKSPACE_METRICS_VIEW | Allows viewing workspace-scoped metrics, cost, and usage data. |
| Security & Audit | View Audit Logs | AUDIT_LOGS_VIEW | Allows viewing security audit logs. |
| Runtime Modules | View Runtime Modules | GLOBAL_RUNTIME_MODULE_VIEW | Allows viewing the catalog of runtime plugins/modules. |
| Runtime Modules | Create Runtime Modules | GLOBAL_RUNTIME_MODULE_CREATE | Allows creating new runtime plugins. |
| Runtime Modules | Update Runtime Modules | GLOBAL_RUNTIME_MODULE_UPDATE | Allows editing global runtime plugins. |
| Runtime Modules | Delete Runtime Modules | GLOBAL_RUNTIME_MODULE_DELETE | Allows deleting runtime plugins. |
| Roles Management | View Roles | ROLE_VIEW | Allows viewing global and workspace roles and their permissions mapping. |