RBAC and workspace ops docs ref #1217

katmayb · 2025-10-31T15:57:51Z

Fixes DOC-397, DOC-101

Preview

Organization and workspace operations: https://langchain-5e9cc07a-preview-rbacpe-1762465003-c2183e4.mintlify.app/langsmith/organization-workspace-operations
RBAC: https://langchain-5e9cc07a-preview-rbacpe-1762465003-c2183e4.mintlify.app/langsmith/rbac

github-actions · 2025-10-31T15:59:20Z

Mintlify preview ID generated: preview-rbacpe-1761926321-5f4e52a

github-actions · 2025-11-04T20:32:24Z

Mintlify preview ID generated: preview-rbacpe-1762288317-22ecd67

github-actions · 2025-11-04T20:40:07Z

Mintlify preview ID generated: preview-rbacpe-1762288778-75f4de5

src/langsmith/workspace-operations.mdx

src/langsmith/organization-workspace-operations.mdx

src/langsmith/workspace-operations.mdx

bvs-langchain · 2025-11-06T14:14:49Z

src/langsmith/rbac.mdx

+LangSmith's RBAC system manages user permissions within workspaces. RBAC allows you to control who can access your LangSmith [workspace](/langsmith/administration-overview#workspaces) and what they can do within it.
+
+Each user has:
+- One [**organization role**](#organization-roles) that applies across the entire organization (separate from RBAC, available on all plans).


Would say separate from workspace rbac - we do technically have org rbac, it's just a limited set of permissions (manage, create pats, and read), and we don't support custom combinations of org permissions. All org roles are predefined.

Also, org roles are not available in personal orgs i.e. single-workspace orgs. This says all plans, but I believe it's only Plus and above, where multiple workspaces are supported

I think I've now covered this

bvs-langchain · 2025-11-06T14:21:11Z

src/langsmith/rbac.mdx

+To learn how to set up RBAC and assign roles to users, refer to the [User Management guide](/langsmith/user-management#set-up-access-control).
+
+<Note>
+For a comprehensive reference table of workspace-level and organization-level operations and which roles can perform them, refer to the [Workspace Operations Reference](/langsmith/workspace-operations).


If it has org actions as well, maybe name it something else like permissions reference?

I've adjusted the name of that file.

bvs-langchain · 2025-11-06T14:23:57Z

src/langsmith/rbac.mdx

+
+### Organization roles
+
+Organization roles are **distinct from the RBAC feature** and are used to manage organization-wide capabilities. These roles are available on all plans.


Would add that these are system-defined and cannot be modified or extended. While workspace system roles cannot be modified but the list can be extended with custom roles

bvs-langchain · 2025-11-06T14:25:55Z

src/langsmith/rbac.mdx

+**Permissions**:
+- `organization:manage` - Full control over organization settings, SSO, security, billing
+- `organization:read` - Read access to all organization information
+- `organization:pats:create` - Create organization-level personal access tokens


Nit: worth linking to pat docs?

I have linked to those docs, and also linked key terms throughout this page.

bvs-langchain · 2025-11-06T14:26:38Z

src/langsmith/rbac.mdx

+- Invite and remove organization members
+- Assign organization and workspace roles to members
+- Create and manage custom roles
+- Configure RBAC and ABAC (Attribute-Based Access Control) policies


Would day abac is private preview

bvs-langchain · 2025-11-06T14:27:56Z

src/langsmith/rbac.mdx

+- Assign organization and workspace roles to members
+- Create and manage custom roles
+- Configure RBAC and ABAC (Attribute-Based Access Control) policies
+- Manage organization-level API keys and service accounts


We don't really expose service account mgmt, it's under the hood, so would remove

OK, I've removed mentions of "service accounts"

bvs-langchain · 2025-11-06T14:30:18Z

src/langsmith/rbac.mdx

+
+### Workspace Admin
+
+**Description**: Default role with full permissions for all resources and ability to manage workspace.


Would add context of specifically when this is default, or just remove the word

I've removed that for now

bvs-langchain · 2025-11-06T17:09:07Z

src/langsmith/rbac.mdx

+**Description**: Default role with full permissions for most resources. Cannot manage workspace settings or delete certain critical resources.
+
+**Key Differences from Admin**:
+- Cannot delete annotation queues


I believe Editor can delete AQS actually

Editor can actually do all of these actions minus deleting runs and managing workspace settings

Ah, ok, I've edited this

bvs-langchain · 2025-11-06T17:11:24Z

src/langsmith/workspace-operations.mdx

+
+The list includes API operations in LangSmith along with:
+
+- Which roles can perform each operation.


Suggested change

- Which roles can perform each operation.

- Which system roles can perform each operation.

bvs-langchain · 2025-11-06T17:13:38Z

src/langsmith/workspace-operations.mdx

+| **Core resources:**<br/>• [Projects](#projects): Organize traces and runs<br/>• [Runs](#runs): Individual execution traces<br/>• [Datasets](#datasets): Test datasets for evaluation<br/>• [Examples](#examples): Individual dataset examples<br/>• [Experiments](#experiments): Comparative experiments | **Core management:**<br/>• [Organization settings](#organization-settings): Org info and configuration<br/>• [Workspaces](#workspaces): Workspace management<br/>• [Organization members](#organization-members): Member management<br/>• [Roles and permissions](#roles-and-permissions): Custom roles |
+| **Monitoring and analysis:**<br/>• [Rules](#rules): Automated run rules<br/>• [Alerts](#alerts): Alert rules for monitoring<br/>• [Feedback](#feedback): Scores and labels on outputs<br/>• [Annotation Queues](#annotation-queues): Human review queues<br/>• [Charts](#charts): Custom visualizations | **Security and authentication:**<br/>• [SSO and authentication](#sso-and-authentication): Single sign-on setup<br/>• [SCIM](#scim): Identity provisioning<br/>• [Access policies](#access-policies): Attribute-based access control |
+| **Development and configuration:**<br/>• [Prompts](#prompts): Prompt templates (LangChain Hub)<br/>• [Deployments](#deployments): Deployment configurations<br/>• [MCP Servers](#mcp-servers): Model Context Protocol servers | **Billing and accounts:**<br/>• [Billing and payments](#billing-and-payments): Subscription management<br/>• [API keys and service accounts](#api-keys-and-service-accounts): Org-level keys |
+| **Workspace management:**<br/>• [Workspace settings](#workspace-settings-and-management): Members, settings<br/>• [API Keys & Secrets](#api-keys-and-secrets): Authentication credentials<br/>• [Tags](#tags): Metadata tagging system<br/>• [Bulk Exports](#bulk-exports): Data export operations | **Analytics:**<br/>• [Charts and dashboards](#organization-charts-and-dashboards): Org-level visualizations<br/>• [Usage and analytics](#usage-and-analytics): Usage tracking and TTL settings |


API keys are managed at the organization level now

OK, I've deleted API keys as a section from the workspace section of this page

bvs-langchain · 2025-11-06T17:16:57Z

src/langsmith/workspace-operations.mdx

+| Operation | Workspace Admin | Workspace Editor | Workspace Viewer | Required Permission |
+|-----------|:---------------:|:--------------:|:----------------:|---------------------|
+| Send traces from SDK (create run) | ✓ | ✓ | ✗ | `runs:create` |
+| Batch ingest runs | ✓ | ✓ | ✗ | `runs:create` |


would name this the same as above, so Send traces from SDK or via API (batch). and below, Send traces from SDK or via API (multipart). these are essentially the same operations, trace ingestion, just different endpoints. same with OTEL.

thinking a bit more, maybe

Submit traces (includes single run, batch, multipart, and OTEL): runs:create

I think I've taken care of this correctly!

katmayb · 2025-11-06T21:13:56Z

src/langsmith/administration-overview.mdx

+- [Workspace Admin](/langsmith/rbac#workspace-admin) has full access to all resources within the workspace.
+- [Workspace Editor](/langsmith/rbac#workspace-editor) has full permissions except for workspace management (adding/removing users, changing roles, configuring service keys).
+- [Workspace Viewer](/langsmith/rbac#workspace-viewer) has read-only access to all resources within the workspace.


@bvs-langchain I added "Workspace" to the front of these roles to match what I'd done in the operations reference, but now I'm realizing that they are Admin, Viewer, and Editor in the UI. Should I remove "Workspace" from all the roles that include that in this PR, or do you think it's good to keep in order to differentiate from the Org roles?

github-actions · 2025-11-06T21:27:40Z

Mintlify preview ID generated: preview-rbacpe-1762464426-c6f1c05

github-actions · 2025-11-06T21:37:16Z

Mintlify preview ID generated: preview-rbacpe-1762465003-c2183e4

github-actions bot added the langsmith For docs changes to LangSmith label Oct 31, 2025

katmayb force-pushed the rbac-permissions-docs branch from 2770c42 to a4543c5 Compare November 4, 2025 20:31

joaquin-borggio-lc reviewed Nov 5, 2025

View reviewed changes

src/langsmith/workspace-operations.mdx Outdated Show resolved Hide resolved

src/langsmith/organization-workspace-operations.mdx Show resolved Hide resolved

src/langsmith/workspace-operations.mdx Outdated Show resolved Hide resolved

bvs-langchain reviewed Nov 6, 2025

View reviewed changes

bvs-langchain approved these changes Nov 6, 2025

View reviewed changes

katmayb marked this pull request as ready for review November 6, 2025 21:09

katmayb requested a review from lnhsingh as a code owner November 6, 2025 21:09

katmayb commented Nov 6, 2025

View reviewed changes

katmayb changed the title ~~WIP rbac and workspace ops docs ref~~ RBAC and workspace ops docs ref Nov 6, 2025

katmayb added 6 commits November 6, 2025 16:23

rbac and workspace ops docs ref

0baf9c5

Feedback

0264235

Feedback 2

f9cecae

Edits +

d2b5c38

Fix

890fe8a

Resolve merge conflict

16d7b6f

katmayb force-pushed the rbac-permissions-docs branch from ae96b67 to 16d7b6f Compare November 6, 2025 21:26

Link fix

0f7e892


		### Organization roles

		Organization roles are distinct from the RBAC feature and are used to manage organization-wide capabilities. These roles are available on all plans.


		### Workspace Admin

		Description: Default role with full permissions for all resources and ability to manage workspace.


		The list includes API operations in LangSmith along with:

		- Which roles can perform each operation.

	- Which roles can perform each operation.
	- Which system roles can perform each operation.

RBAC and workspace ops docs ref #1217

Are you sure you want to change the base?

RBAC and workspace ops docs ref #1217

Uh oh!

Conversation

katmayb commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview

Uh oh!

github-actions bot commented Oct 31, 2025

Uh oh!

github-actions bot commented Nov 4, 2025

Uh oh!

github-actions bot commented Nov 4, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Nov 6, 2025

Uh oh!

github-actions bot commented Nov 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

katmayb commented Oct 31, 2025 •

edited

Loading