Roles

Roles determine which resources members can access and what actions they can perform in Arize AX. Permissions are managed at the account, organization, and space levels, so you can give a team broad access to its own spaces while limiting who can change account settings or see data in other spaces.

Diagram of Arize AX access levels: an account contains organizations, and organizations contain spaces

Where roles are assigned

Every member has an account role and a role in each space they belong to. Accounts with more than one organization also assign organization roles. In a public space, a member without an explicit space role falls back to their organization role, so you can set a default at the organization and override it in the spaces that need a different role. Custom roles cover cases where the built-in roles grant too much or too little.

Level	Roles	Assign them in
Account	Admin, Member, Member - UI Only, Annotator	Account Settings → Account Members
Space	Admin, Member, Read Only, Annotator	Space Settings → Space Members
Custom	Your own role	Account Settings → Roles
Organization	Admin, Member, Read Only, Annotator	Org Settings → Org Members

Managed roles

Arize AX includes managed roles at every level. These roles are ready to use and cannot be modified.

Account

Role	Description	Developer access
Admin	Full administrative access across the entire account, including user management.	✅
Member	Content creation and management across the account.	✅
Member - UI Only	Content creation and management across the account, without developer access or service key creation.	❌
Annotator	Annotation-only access across the account: access annotation queues and annotate records.	❌

Action	Admin	Member
Remove users and change user roles	✅	❌
Invite users	✅	Up to Member, Member - UI Only, or Annotator. See who can invite whom.
Create organizations	✅	❌
Create and manage custom roles	✅	❌
Manage AI provider integrations	✅	❌
Create API keys	✅	With developer access
Create service keys	✅	With developer access and access to the target space

Organization

Role	Description
Admin	Full administrative access within an organization, excluding user account management.
Member	Content creation and management within an organization.
Read-only	Read-only access to all resources within an organization.
Annotator	Annotation-only access within an organization: access annotation queues and annotate records.

Action	Admin	Member	Read-only
Invite and remove organization members and change their roles	✅	❌	❌
Create spaces	✅	✅	❌
View public spaces	✅	✅	✅
Edit public spaces	✅	✅	Only if added to the space
View private spaces	✅	Only if added to the space	Only if added to the space
Create integration keys	✅	✅	❌
Edit or delete integration keys	✅	Only keys they created	❌
Manage AI provider integrations	✅	❌	❌

Space

Role	Description
Admin	Full admin access within a space. Has full create, read, update, and delete access to every child resource within the space.
Member	Content creation and management within a space.
Read-only	Read-only access to all resources within a space.
Annotator	Annotation access for projects, datasets, experiments, and queues within a space.

Action	Admin	Member	Read-only	Annotator
Manage space members	✅	❌	❌	❌
Create projects	✅	✅	❌	❌
Delete projects and models	✅	❌	❌	❌
Delete spans and ML data	✅	❌	❌	❌
Send traces	✅	✅	❌	❌
Create and delete file import jobs	✅	❌	❌	❌
Update model settings	✅	✅	❌	❌
Create and edit dashboards	✅	✅	❌	❌
Create and edit monitors	✅	✅	❌	❌
View project entities (datasets, monitors, dashboards)	✅	✅	✅	❌
Create and edit evaluation tasks	✅	✅	❌	❌
Create and edit datasets	✅	✅	❌	❌
Run experiments	✅	✅	❌	❌
Annotate spans	✅	✅	❌	❌
Create, edit, and delete prompts	✅	✅	❌	❌
Create and edit evaluators	✅	✅	❌	❌
Create and edit custom metrics	✅	✅	❌	❌
Manage tags	✅	✅	❌	❌
View and manage Data Fabric	✅	✅	❌	❌
Access annotation queues	✅	✅	✅	✅
Run Playground	✅	✅	✅	❌

Project

Three managed project-level roles are designed for resource restrictions.

Capability	Viewer	Editor	Admin
View project, traces, and spans	✅	✅	✅
Read evaluations	✅	✅	✅
Send traces (create and update spans)	❌	✅	✅
Annotate traces	❌	✅	✅
Manage evaluation tasks	❌	✅	✅
Create Projects	❌	❌	✅
Delete project	❌	❌	✅
Manage project access and restrictions	❌	❌	❌

You can also create custom roles with any combination of project-level permissions to suit your specific needs.

Developer access

Developer access is required to create API keys and service keys. It comes from the account role’s grants_developer_access attribute.

Account role	Grants developer access
Admin	✅
Member	✅
Member - UI Only	❌
Annotator	❌

An Account Admin can override developer access for one user in Account Settings, with PATCH /v2/users/{user_id} in the RBAC REST API, or with ax users update. Assigning an account role, even the same one, recomputes developer access from the role and drops the override. A SAML login that leaves the account role unchanged keeps it. Revoking developer access deletes the user’s API keys.

Account-wide developer access lock

Account Admins can turn on the developer access lock under Account Settings → Security. While the lock is on, human users cannot call the REST or GraphQL APIs with user keys or OAuth credentials, and nobody can create or refresh an API key or service key, Account Admins included. Stored developer access is unchanged. Existing service keys keep working within their roles and scopes.

Custom roles

A custom role is a named, account-wide set of permissions. Only Account Admins create them. A role binding assigns one to a user on a space or project.

Go to Account Settings → Roles and click New Role.
Enter a name.
Choose the permissions. The permission list is searchable. To start from an existing role, clone it from the roles table and edit the copy.
Click Save Role.

Permission categories

When you create or edit a custom role, permissions are grouped into the categories below. You can select individual permissions within each category.

Category	Permissions
Projects & Traces	View, create, update, and delete projects, and restrict project access. View, annotate, create, update, and delete spans. Update evaluation feedback on spans. Manage trace views.
Dashboards	View, create, update, and delete dashboards, and restrict dashboard access. Manage dashboard templates.
Monitors	View, create, update, delete, and trigger monitors.
Custom Metrics	View, create, update, and delete custom metrics.
Datasets & Experiments	Manage datasets, dataset examples (including annotating examples), dataset views, experiments, and experiment runs (including annotating runs).
Tasks	Manage evaluation tasks for projects and experiments.
Prompts	Manage prompts, including restricting prompt access. Manage prompt optimization tasks. Run the playground and manage playground views.
Evaluators	View, create, update, and delete evaluators.
Annotations	Manage annotation configs, labeling queues, and labeling queue records (including annotating records).
Tags	View, create, update, and delete tags.
Data Fabric	Manage data fabric connectors.
Alyx	Run Alyx.
Managed Agents	Manage managed agents and agent roles.
Users	View, create, update, and delete users, and update user permissions.
Spaces	View, create, update, and delete spaces.
Roles	Manage custom roles and role bindings.
API Keys	Create, view, and revoke service keys.
ML Models	Manage ML models and file import jobs.
Integrations	Manage remote endpoint integrations.
AI Providers	View AI provider integrations.
Cost Configs	View cost configurations.

The AI Providers category grants read access only. On accounts created before July 27, 2026, managing AI provider integrations requires Organization Admin or Account Admin. Newer accounts also allow Space Admins and Account Members.

Managed Agents permissions control who can view and run agents in a space. Viewing Signal issues uses project read access. Enabling or configuring Signal uses project update. See Skills and permissions.

Role bindings

A role binding assigns a role to a user on one space or project, with at most one binding per user per resource. Effective access is the union of the built-in role and all bindings.

Assign roles

A role is assigned to a member on a space or, for restricted projects, on a project:

Invitation: Choose the role when you invite someone to a space. See Invite & Manage Members.
Members table: Go to Settings → Space Settings → Space Members, then change the member’s role in the table.
Project access: On a restricted project, open Config → Access Control and add the user with a project role.
SAML role mapping: Map identity provider attributes to roles so they are assigned at each sign-in. See SAML Configuration.
REST API: See the RBAC REST API.

Quickstart

Instrument

Observe

Agents

Evaluate

Experimentation

Settings & Access

Network & Connectivity

Security

Migrate

Machine Learning

Where roles are assigned

Managed roles

Account

Organization

Space

Project

Developer access

Custom roles

Permission categories

Role bindings

Assign roles

​Where roles are assigned

​Managed roles

​Account

​Organization

​Space

​Project

​Developer access

​Custom roles

​Permission categories

​Role bindings

​Assign roles

Where roles are assigned

Managed roles

Account

Organization

Space

Project

Developer access

Custom roles

Permission categories

Role bindings

Assign roles