Skip to main content
Baseten uses role-based access control (RBAC) to manage organization access. In organizations that use a single team, every organization member has one of three roles. Admins have full control over the organization, including member management and billing. Members can deploy, manage, and call resources but can’t manage organization settings or other users. Viewers have read-only access to workspace resources and can call deployed resources. They can’t deploy resources or change their configuration. Viewers can inspect models, Chains, deployments, training projects and jobs, logs, metrics, resource activity, environment settings, members, and secret metadata. Secret listings never expose stored values. Viewers can also create personal API keys, which inherit their Viewer permissions, but they can’t create team API keys. In a single-team organization, the role menu combines organization and default-team access into the Admin, Member, and Viewer options. The Viewer option assigns the organization Member role together with the Viewer role on the default team.

​
Assign a role

To invite a member or change a member’s role:
  1. Sign in to your workspace at app.baseten.co and open Organization settings, then choose the Members tab.
  2. Choose Invite member, or choose the pencil icon next to an existing member.
  3. Select Admin, Member, or Viewer.
  4. Invite the member or save your changes.
If your organization uses multiple teams, Viewer is a team role rather than an organization role. A Viewer keeps the organization Member role and receives Viewer access separately for each team. See Teams for the two-level role model.
If your organization uses Single sign-on (SSO), users provisioned through your identity provider join with the Member role by default. Role and membership changes are recorded in the audit log.