Skip to main content
Roles determine which resources members can access and what actions they can perform in Arize AX. Permissions are managed at the account, organization, and space levels, so you can give a team broad access to its own spaces while limiting who can change account settings or see data in other spaces.

​
Where roles are assigned

Every member has an account role and a role in each space they belong to. Accounts with more than one organization also assign organization roles. In a public space, a member without an explicit space role falls back to their organization role, so you can set a default at the organization and override it in the spaces that need a different role. Custom roles cover cases where the built-in roles grant too much or too little.

​
Developer access

Developer access is required to create API keys and service keys. Account Admins and Account Members have it by default, while Member - UI Only and Annotator members do not. Annotators cannot invite members. Members and UI-only members can invite people if the account allows it.
Account Admins can turn on the developer access lock under Account Settings → Security. While the lock is on, user keys cannot call the REST API, and nobody can create or refresh API keys or service keys. This applies to Account Admins too. Existing service keys keep working.

​
Custom roles

A custom role is a named set of permissions you choose. It is assigned as a space role, either in an invitation or through a SAML role mapping.
  1. Go to Account Settings → Roles and click New Role.
  2. Enter a name.
  3. Choose the permissions. The permission list is searchable. A preset role can be used as a starting point.
  4. Click Save Role.
Roles are assigned in Invite & Manage Members.