Role-Based Access Control (RBAC) — GlomaxGPT Developer Platform

Two Levels of Access — GlomaxGPT RBAC operates at two scopes: Organization level (manages billing, members, settings, and all projects) and Project level (manages API keys, models, and resources within a specific project). A user can have different roles at each level.

Org-Level Roles

Control access to billing, member management, organization settings, and the ability to create and delete projects.

Project-Level Roles

Control access to API keys, model usage, fine-tuning, vector stores, and other resources within a specific project.

Custom Roles

Build custom roles with precisely the permissions your team needs. Available on Pro and Enterprise plans.

Built-in Roles

Four built-in roles cover the most common access patterns. Assign them at the organization or project level as needed.

Owner

Org only

Full administrative control over the organization. Can manage billing, invite members, create and delete projects, configure SSO, manage all API keys, and access all usage data.

Limit Owner accounts. Assign this role only to a small number of trusted administrators. Enable MFA for all Owner accounts.

Billing management Member management SSO configuration Delete organization All project access

Admin

Org & Project

Manages day-to-day operations. At org level: can invite members, create projects, and manage API keys. At project level: full control over project resources including models, fine-tuning, and vector stores.

Invite members Create projects Manage API keys Fine-tuning access Vector store admin

Member

Org & Project

Standard developer access. Can create and use API keys, make API calls, upload files, use the Playground, and access models within their assigned projects. Cannot manage members or billing.

Create API keys Make API calls Upload files Playground access View usage (own)

Reader

Org & Project

Read-only access. Can view API usage, model configurations, and project settings but cannot create API keys, make API calls, or modify any resources. Ideal for auditors and stakeholders.

View usage data View settings View audit logs No API access No modifications

Permissions Reference

The table below shows which permissions are available to each built-in role at the organization level.

Permission	Owner	Admin	Member	Reader
Billing & Payments
View billing information
Invite / remove members
Assign / change member roles
Configure SSO / SCIM
Create / delete projects
Create API keys (org-level)
Create API keys (project-level)
Make API calls
Fine-tune models
Upload files / vector stores
Configure IP allowlist
View usage (all members)
View audit logs
Delete organization

Custom Roles

Create custom roles with precisely the permissions your team needs. Custom roles are composed by selecting individual permissions from the full permissions catalog and are available on Pro and Enterprise plans.

Plan Availability — Custom roles are available on the Pro and Enterprise plans. The Free and Pay-as-you-go plans support built-in roles only. Custom roles can be created and managed via the dashboard or the Admin API.

Creating a Custom Role via API

Python — Create Custom Role

import requests
import os

ADMIN_KEY = os.environ["GlomaxGPT_ADMIN_KEY"]
ORG_ID = os.environ["GlomaxGPT_ORG_ID"]

# Create a custom "ML Engineer" role
response = requests.post(
    f"https://api.glomaxgpt.com/v1/organization/roles",
    headers={
        "Authorization": f"Bearer {ADMIN_KEY}",
        "Content-Type": "application/json",
        "GlomaxGPT-Organization": ORG_ID
    },
    json={
        "name": "ML Engineer",
        "description": "Can fine-tune models and manage vector stores, but not manage members or billing",
        "permissions": [
            "api.requests",
            "fine_tuning.create",
            "fine_tuning.read",
            "fine_tuning.delete",
            "files.create",
            "files.read",
            "files.delete",
            "vector_stores.create",
            "vector_stores.read",
            "vector_stores.delete",
            "usage.read.own"
        ]
    }
)

role = response.json()
print(f"Created role: {role['id']} — {role['name']}")

Python — Assign Custom Role to Member

import requests
import os

ADMIN_KEY = os.environ["GlomaxGPT_ADMIN_KEY"]
ORG_ID = os.environ["GlomaxGPT_ORG_ID"]

# Assign custom role to a user by their member ID
response = requests.patch(
    f"https://api.glomaxgpt.com/v1/organization/members/user_abc123",
    headers={
        "Authorization": f"Bearer {ADMIN_KEY}",
        "Content-Type": "application/json",
        "GlomaxGPT-Organization": ORG_ID
    },
    json={
        "role": "role_ml_engineer_xyz"  # Custom role ID
    }
)

print(response.json())

Python — List All Roles

import requests
import os

ADMIN_KEY = os.environ["GlomaxGPT_ADMIN_KEY"]

response = requests.get(
    "https://api.glomaxgpt.com/v1/organization/roles",
    headers={"Authorization": f"Bearer {ADMIN_KEY}"}
)

roles = response.json()
for role in roles["data"]:
    print(f"{role['name']} ({role['id']}) — {len(role['permissions'])} permissions")

Python — Delete Custom Role

import requests
import os

ADMIN_KEY = os.environ["GlomaxGPT_ADMIN_KEY"]

# Delete a custom role (built-in roles cannot be deleted)
response = requests.delete(
    f"https://api.glomaxgpt.com/v1/organization/roles/role_ml_engineer_xyz",
    headers={"Authorization": f"Bearer {ADMIN_KEY}"}
)

if response.status_code == 200:
    print("Role deleted successfully")
else:
    print(f"Error: {response.json()}")

Project-Level Access

Projects are isolated environments within your organization. Each project has its own API keys, model access settings, usage limits, and resource quotas. Users can be assigned different roles in different projects.

Principle of Least Privilege — Assign users to specific projects with the minimum role required for their work. A developer working on Project A should not automatically have access to Project B's resources or API keys.

Scenario	Recommended Setup
Developer building a chatbot	Project-level Member on the chatbot project only
Data scientist running fine-tuning	Project-level Member or custom ML Engineer role
External auditor reviewing usage	Project-level Reader on specific projects
DevOps managing API keys	Project-level Admin with no org-level billing access
Finance reviewing spend	Org-level Reader (view usage only)
CI/CD service account	Project-level Member with scoped API key; no dashboard access

Assigning Project Roles via API

Python — Add User to Project with Role

import requests
import os

ADMIN_KEY = os.environ["GlomaxGPT_ADMIN_KEY"]
PROJECT_ID = "proj_abc123"

# Add a user to a specific project with the Member role
response = requests.post(
    f"https://api.glomaxgpt.com/v1/organization/projects/{PROJECT_ID}/members",
    headers={
        "Authorization": f"Bearer {ADMIN_KEY}",
        "Content-Type": "application/json"
    },
    json={
        "user_id": "user_dev_xyz",
        "role": "member"
    }
)

print(response.json())

# List all members of a project
members_resp = requests.get(
    f"https://api.glomaxgpt.com/v1/organization/projects/{PROJECT_ID}/members",
    headers={"Authorization": f"Bearer {ADMIN_KEY}"}
)

for member in members_resp.json()["data"]:
    print(f"{member['user']['email']} — {member['role']}")

API Key Scoping

API keys can be scoped to specific projects and given restricted permissions. This limits blast radius if a key is compromised.

Project-Scoped Keys

Keys created within a project can only access that project's resources. They cannot cross project boundaries even within the same organization.

Project isolation Recommended default

Permission-Restricted Keys

Restrict a key to specific API capabilities: read-only files, responses-only, no fine-tuning. Enterprise feature for service accounts.

Fine-grained scopes Service accounts

Python — Create Scoped API Key

import requests
import os

ADMIN_KEY = os.environ["GlomaxGPT_ADMIN_KEY"]
PROJECT_ID = "proj_abc123"

# Create a read-only service account key for a CI system
response = requests.post(
    f"https://api.glomaxgpt.com/v1/organization/projects/{PROJECT_ID}/api_keys",
    headers={
        "Authorization": f"Bearer {ADMIN_KEY}",
        "Content-Type": "application/json"
    },
    json={
        "name": "ci-pipeline-key",
        "scopes": ["api.requests", "files.read"],
        "expires_at": "2027-01-01T00:00:00Z"
    }
)

key_data = response.json()
print(f"Key ID: {key_data['id']}")
print(f"Key: {key_data['key']}")  # Store securely — shown only once

Key Rotation — Rotate API keys every 90 days as a best practice. Set expiry dates on all service account keys. Immediately revoke any key that may have been exposed.

Sonraki Adımlar

Review the full Security overview to configure encryption, network controls, SSO, and audit logging alongside your RBAC setup.

Security Overview → View Plans →

Rol Tabanlı Erişim Kontrolü

Org-Level Roles

Project-Level Roles

Custom Roles

Built-in Roles

Owner

Admin

Member

Reader

Permissions Reference

Custom Roles

Creating a Custom Role via API

Project-Level Access

Assigning Project Roles via API

API Key Scoping

Project-Scoped Keys

Permission-Restricted Keys

Sonraki Adımlar