Skip to content

Commit a4543c5

Browse files
katmaybkatmayb
committed
rbac and workspace ops docs ref
1 parent d383aad commit a4543c5

File tree

5 files changed

+765
-2
lines changed

5 files changed

+765
-2
lines changed

‎src/docs.json‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -877,8 +877,15 @@
877877
"langsmith/data-purging-compliance"
878878
]
879879
},
880+
{
881+
"group": "Access control & Authentication",
882+
"pages": [
883+
"langsmith/workspace-operations",
884+
"langsmith/rbac",
885+
"langsmith/authentication-methods"
886+
]
887+
},
880888
"langsmith/scalability-and-resilience",
881-
"langsmith/authentication-methods",
882889
"langsmith/faq",
883890
"langsmith/regions-faq",
884891
"langsmith/pricing-faq"

‎src/langsmith/administration-overview.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@ Roles can be managed in organization settings under the `Roles` tab:
170170

171171
![Roles](/langsmith/images/roles-tab-rbac.png)
172172

173-
For more details on assigning and creating roles, see the [access control setup guide](/langsmith/user-management).
173+
For comprehensive documentation on roles and permissions, refer to the [Role-based access control](/langsmith/rbac) guide. For a detailed operations reference table, refer to the [Workspace Operations](/langsmith/workspace-operations) page. For more details on assigning and creating roles, refer to the [User Management](/langsmith/user-management) guide.
174174

175175
## Best Practices
176176

‎src/langsmith/rbac.mdx‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
---
2+
title: Role-based access control
3+
sidebarTitle: Role-based access control
4+
---
5+
6+
This reference explains LangSmith's Role-Based Access Control (RBAC) system for managing workspace-level permissions.
7+
8+
<Note>
9+
RBAC (Role-Based Access Control) is an Enterprise feature for managing workspace-level permissions. If you are interested in this feature, [contact our sales team](https://www.langchain.com/contact-sales). Other plans default to using the Admin role for all users.
10+
</Note>
11+
12+
LangSmith's RBAC system manages user permissions within workspaces. RBAC allows you to control who can access your LangSmith [workspace](/langsmith/administration-overview#workspaces) and what they can do within it.
13+
14+
Each user has:
15+
- One [**organization role**](#organization-roles) that applies across the entire organization (separate from RBAC, available on all plans).
16+
- One [**workspace role**](#workspace-roles) per workspace they're a member of (requires Enterprise RBAC feature).
17+
18+
On Enterprise plans, organizations can create [custom workspace roles](#custom-roles) with granular permission combinations.
19+
20+
To learn how to set up RBAC and assign roles to users, refer to the [User Management guide](/langsmith/user-management#set-up-access-control).
21+
22+
<Note>
23+
For a comprehensive reference table of workspace-level and organization-level operations and which roles can perform them, refer to the [Workspace Operations Reference](/langsmith/workspace-operations).
24+
</Note>
25+
26+
## Role types
27+
28+
### Organization roles
29+
30+
Organization roles are **distinct from the RBAC feature** and are used to manage organization-wide capabilities. These roles are available on all plans.
31+
32+
| Role | Description |
33+
|------|-------------|
34+
| Organization Admin | Full permissions to manage organization configuration, users, billing, and workspaces |
35+
| Organization User | Read access to organization information and ability to create personal access tokens |
36+
| Organization Viewer | Read-only access to organization information |
37+
38+
### Workspace roles
39+
40+
Workspace roles are part of the **Enterprise RBAC feature** and control what users can do with resources inside a workspace:
41+
42+
| Role | Description |
43+
|------|-------------|
44+
| Workspace Admin | Full permissions for all resources and ability to manage workspace |
45+
| Workspace Editor | Full permissions for most resources, cannot manage workspace settings or delete certain resources |
46+
| Workspace Viewer | Read-only access to all workspace resources |
47+
48+
## Organization roles
49+
50+
<Info>
51+
Organization roles are **distinct from the RBAC feature** and are available on all plans. They control organization-wide capabilities and workspace membership. For more details, see the [Administration Overview](/langsmith/administration-overview#organization-roles).
52+
</Info>
53+
54+
### Organization Admin
55+
56+
**Description**: Full permissions to manage all organization configuration, users, billing, and workspaces.
57+
58+
**Permissions**:
59+
- `organization:manage` - Full control over organization settings, SSO, security, billing
60+
- `organization:read` - Read access to all organization information
61+
- `organization:pats:create` - Create organization-level personal access tokens
62+
63+
**Key Capabilities**:
64+
- Manage organization settings and branding
65+
- Configure [SSO and authentication methods](/langsmith/user-management#set-up-saml-sso-for-your-organization)
66+
- Manage billing and subscription plans
67+
- Create and delete workspaces
68+
- Invite and remove organization members
69+
- Assign organization and workspace roles to members
70+
- Create and manage custom roles
71+
- Configure RBAC and ABAC (Attribute-Based Access Control) policies
72+
- Manage organization-level API keys and service accounts
73+
- View organization usage and analytics
74+
75+
For details on setting up and managing your organization, refer to the [Administration Overview](/langsmith/administration-overview#organizations).
76+
77+
### Organization User
78+
79+
**Description**: Read access to organization information and ability to create personal access tokens.
80+
81+
**Permissions**:
82+
- `organization:read` - Read access to organization information
83+
- `organization:pats:create` - Create personal access tokens
84+
85+
**Key Capabilities**:
86+
- View organization members and workspaces
87+
- View organization settings (but not modify)
88+
- Create personal access tokens for API access
89+
- Join workspaces they're invited to
90+
91+
**Restrictions**:
92+
- Cannot modify organization settings
93+
- Cannot manage billing or subscriptions
94+
- Cannot create or delete workspaces
95+
- Cannot invite or remove organization members
96+
- Cannot manage roles or permissions
97+
98+
### Organization Viewer
99+
100+
**Description**: Read-only access to organization information.
101+
102+
**Permissions**:
103+
- `organization:read` - Read access to organization information
104+
105+
**Key Capabilities**:
106+
- View organization members and workspaces
107+
- View organization settings
108+
109+
**Restrictions**:
110+
- Cannot modify anything at the organization level
111+
- Cannot create personal access tokens
112+
- Cannot manage billing, workspaces, or members
113+
114+
## Workspace roles
115+
116+
<Note>
117+
RBAC (Role-Based Access Control) is a feature that is only available to Enterprise customers. If you are interested in this feature, [contact our sales team](https://www.langchain.com/contact-sales). Other plans default to using the Admin role for all users.
118+
</Note>
119+
120+
### Workspace Admin
121+
122+
**Description**: Default role with full permissions for all resources and ability to manage workspace.
123+
124+
**Permissions**:
125+
- All create, read, update, delete, and share permissions for all resource types
126+
- Workspace management capabilities
127+
128+
### Workspace Editor
129+
130+
**Description**: Default role with full permissions for most resources. Cannot manage workspace settings or delete certain critical resources.
131+
132+
**Key Differences from Admin**:
133+
- Cannot delete annotation queues
134+
- Cannot create or delete projects (can only read and update)
135+
- Cannot delete datasets
136+
- Cannot share datasets
137+
- Cannot delete deployments
138+
- Cannot delete runs
139+
- Cannot manage workspace settings (add/remove members, change workspace name, etc.)
140+
141+
### Workspace Viewer
142+
143+
**Description**: Read-only access to all workspace resources.
144+
145+
**Permissions**: Read-only access to all resource types.
146+
147+
<Tip>
148+
For step-by-step instructions on assigning workspace roles to users, refer to the [User Management guide](/langsmith/user-management#assign-a-role-to-a-user).
149+
</Tip>
150+
151+
## Custom roles
152+
153+
<Info>Creating custom roles is available for organizations on the Enterprise plan.</Info>
154+
155+
Organization Admins can create custom roles with specific combinations of permissions tailored to their organization's needs.
156+
157+
### Creating custom roles
158+
159+
Custom roles are created at the organization level and can be assigned to users in any workspace within that organization.
160+
161+
**Steps**:
162+
1. Navigate to Organization **Settings** > **Roles**.
163+
2. Click **Create Custom Role**.
164+
3. Select the permissions to include in the role.
165+
4. Assign the custom role to users in specific workspaces.
166+
167+
For details on which specific permissions are required for each operation, refer to the [Workspace Operations Reference](/langsmith/workspace-operations).
168+
169+
Note the following details on custom roles:
170+
171+
- Custom roles can only be created and managed by Organization Admins.
172+
- Custom roles are organization-specific (not transferable between organizations).
173+
- Each custom role can have any combination of workspace-level permissions.
174+
- Custom roles cannot have organization-level permissions.
175+
- Users can have different roles (including custom roles) in different workspaces.

‎src/langsmith/user-management.mdx‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ You may find it helpful to read the [Administration overview](/langsmith/adminis
2121

2222
LangSmith relies on RBAC to manage user permissions within a [workspace](/langsmith/administration-overview#workspaces). This allows you to control who can access your LangSmith workspace and what they can do within it. Only users with the `workspace:manage` permission can manage access control settings for a workspace.
2323

24+
For a complete reference of workspace roles and their permissions, refer to the [Role-based access control](/langsmith/rbac#workspace-roles) guide. For specific operations each role can perform, refer to the [Workspace Operations Reference](/langsmith/workspace-operations).
25+
2426
### Create a role
2527

2628
By default, LangSmith comes with a set of system roles:

0 commit comments

Comments
 (0)