Members & Roles
ANTS Platform uses role-based access control (RBAC). Every member of an organization holds one role. A member can also hold a different role in a specific project. The role decides which pages appear in the sidebar and which actions the server allows. Anything a role does not grant stays hidden and is refused.
Manage organization members under Organization Settings → Members. Manage project members under Project Settings → Members. For roles you design yourself, see Custom Roles. For how the permission model works, see Access Control (RBAC).
Organization and project scope
| Scope | Where it is set | What it controls |
|---|---|---|
| Organization role | Organization Settings → Members | Organization-wide settings (members, SSO, data retention, billing, API keys) and the default access to every project in the organization. |
| Project role | Project Settings → Members | Access inside one project. It replaces the organization role for that project only. |
How the two combine:
- A member with no project role uses their organization role in every project of the organization.
- A project role (built-in or custom) replaces the organization role for that project. It can be higher or lower than the organization role.
- In the project role dropdown, None (keep default role) means "do not override": the member keeps their organization role in that project.
- An organization role of None gives no organization access. The member only sees projects where they hold a project role.
- A member only sees a project when their effective role in it grants at least read access to the project.
Project roles need the rbac-project-roles entitlement (the Enterprise cloud plan, and the Pro and Enterprise self-hosted plans). Without it, the Project Role field does not appear and members use their organization role everywhere. See Billing & Plans.
Built-in roles
| Role | Intended for | Summary |
|---|---|---|
| Owner | Platform owners | Full access to every module, every setting and every project. The only built-in role that can manage billing, API keys, integrations, LLM connections, custom roles, and create or delete projects and the organization. |
| Department Admin | Business unit or department administrators | Runs Discover AI, Gauge AI and Budget AI, manages members and invitations, exports data. Read-only in Governance. No audit logs, no prompt content, no tenant security settings. |
| Security & Compliance | Security, risk and compliance teams | Administers Governance (guardrails, approvals, evidence), reads and exports audit logs, reads prompt and response content, administers tenant security (SSO, MFA, feature visibility, data retention, Budget AI key incident response). Cannot manage members. |
| Cost Analyst | FinOps and cost reporting | Full Gauge AI (cost dashboards, AI Optimizer, AI Agent Center), read-only Discover AI and Budget AI, data export. |
| Auditor | Internal or external auditors | Read-only Governance, Budget AI and AI TrailMaps. Reads audit logs and downloads existing audit reports. |
| Manager Viewer | Reserved | No module access. The member can sign in and open the project, nothing more. |
| End User | Default role for new users | No module access. The member can sign in and open the project, nothing more. |
| None | Organization: project-only members. Project: keep the organization role. | At organization level, no access until a project role is granted. At project level, inherits the organization role. |
Manager Viewer and End User are not offered in the role dropdowns. A member gets End User when they join through a default organization or project configured for the deployment, or when a Budget AI key is issued to them with project access. Both roles can also be set through SCIM provisioning. Per-team and own-data-only views for these roles are not available yet.
Permission matrix
Access levels are Read, Read & Write and Admin. A dash means no access. "Full" means the Owner holds every permission in the module.
| Module | Owner | Department Admin | Security & Compliance | Cost Analyst | Auditor | Manager Viewer, End User |
|---|---|---|---|---|---|---|
| Discover AI | Full | Read & Write | Read | Read | - | - |
| AI TrailMaps | Read | Read | Read | - | Read | - |
| Gauge AI | Full | Read & Write | Read | Read & Write | - | - |
| Governance | Full | Read | Admin | - | Read | - |
| Budget AI | Full | Admin | Read | Read | Read | - |
| Audit & Export | Full | - | Read & Write | - | Read | - |
| PII / raw-prompt content | Read | - | Read | - | - | - |
| Data export (tables) | Yes | Yes | - | Yes | - | - |
| User data export, AI Agent data export | Yes | - | - | - | - | - |
| User & role management | Full | Read & Write | - | - | - | - |
| Custom-role authoring | Yes | - | - | - | - | - |
| Integrations & service accounts (includes project API keys) | Admin | - | - | - | - | - |
| Tenant security & data retention | Admin | - | Admin | - | - | - |
| Billing & subscription | Yes | - | - | - | - | - |
| Ants Assist | Full | Read & Write | - | - | - | - |
Owner also holds permissions that no other built-in role has: LLM connections, model price definitions, prompts, scores and evaluation settings, protected prompt labels, organization API keys, renaming and deleting the organization, and creating, renaming and deleting projects.
What each level allows
Discover AI
- Read: AI Usage Intelligence, AI Tools, Users, Devices, discovered AI agents, and the Discover AI configuration pages in read-only mode.
- Read & Write: also sanction tools and manage custom apps, and change Discover AI configuration (policy, tool registry, directory, enrollment keys for the desktop agents and browser extension).
Gauge AI
- Read: AI Agent Center, AI Optimizer results, Cost Dashboard, Latency Dashboard, Cost Performance Metrics, Latency & Analytics, AI Usage and per-user cost (Users).
- Read & Write: also change AI Agent Center settings, run AI Optimizer comparisons and edit dashboards.
Governance
- Read: Risk Dashboard, AI Guardrails (view policies), AI Violations, My Requests, Available Requests, Evidence Collection, Framework Coverage, agent profiles, AI Inventory, and the trace and session lists under Tracing and Sessions.
- Admin: also edit guardrail policies, raise compliance requests, act on and approve requests in the queue, edit evidence, agent profiles and the AI Inventory, and configure notification automations (Slack, Jira, Linear, PagerDuty, ServiceNow routing).
Budget AI
- Read: Overview, Keys (aliases, limits, spend and status, never key material), Budgets & Limits, Models & Routing (provider credentials masked) and project Budget AI settings.
- Admin: also issue, block and delete keys, manage budgets, provider credentials, model groups and routing, and change Budget AI settings.
Audit & Export
- Read: open Organization Settings → Audit Logs, and list and download existing reports on the Governance Audit & Export page.
- Read & Write: also generate new audit and evidence reports.
Tenant security & data retention (Admin)
- SSO settings, the Features tab (feature visibility), the Two-step sign-in switch under General → Security, Data Retention, and blocking or unblocking Budget AI keys during an incident.
Some modules also need a plan entitlement, a feature flag or deployment configuration before their pages appear, whatever the role. Budget AI needs the llm-gateway entitlement and the Budget AI feature to be enabled. AI TrailMaps must be enabled for the deployment. Governance and Discover AI pages are enterprise features.
The content permission
PII / raw-prompt content is a separate, gated permission. It controls who can read the actual text of prompts and responses: trace and session input and output, observation bodies, and the flagged content behind AI Violations. Seeing a trace list, a violation count or a dashboard does not require it.
- Built-in roles with this permission: Owner and Security & Compliance.
- Department Admin, Cost Analyst and Auditor can list traces and violations but cannot open their content.
- Traces and sessions that someone published with a public link stay readable through that link.
- Organization owners and Security & Compliance members can also hide trace input and output for the whole organization, or per project. See Data Privacy.
Settings visible to each role
Settings tabs appear only when the role holds the permission behind them.
| Organization Settings tab | Visible to |
|---|---|
| General | Every member (renaming and deleting the organization is Owner only) |
| Budget AI | Owner, Department Admin, Security & Compliance, Cost Analyst, Auditor |
| Features | Owner, Security & Compliance |
| Members | Owner, Department Admin |
| Users (directory roster, Enterprise) | Owner, Department Admin, Security & Compliance, Cost Analyst |
| Custom Roles (Enterprise) | Owner |
| Group Role Mappings | Owner |
| API Keys | Owner |
| Integrations (directory and Microsoft 365 connectors, Enterprise) | Owner, Department Admin, Security & Compliance, Cost Analyst |
| Audit Logs | Owner, Security & Compliance, Auditor |
| Data Retention | Owner, Security & Compliance |
| Notifications | Every member |
| Billing | Owner |
| SSO | Owner, Security & Compliance (cloud plans only) |
| Project Settings tab | Visible to |
|---|---|
| General | Every project member (renaming and deleting is Owner only) |
| Members | Owner, Department Admin |
| API Keys | Owner |
| Deployment & Keys, Discover AI, Tool Registry | Owner, Department Admin, Security & Compliance, Cost Analyst |
| LLM Connections, Ants Assist, Protected Prompt Labels, Scores / Evaluation | Owner |
| Integrations | Owner |
| Budget AI | Owner, Department Admin, Security & Compliance, Cost Analyst, Auditor |
| Exports | Owner, Department Admin, Cost Analyst |
Members with a custom role see the tabs their role grants.
Inviting members
Open Members
Go to Organization Settings → Members to add someone to the organization, or Project Settings → Members to add someone to one project.
Add member
Select Add member (or Add project member if you only manage that project). Enter the email address.
Choose roles
Pick an Organization Role and, on the project page, a Project Role. Both dropdowns list the built-in roles and, on Enterprise plans, a Custom roles group. Hover a built-in role to see a summary of what it grants.
Grant access
Select Grant access. An existing ANTS user is added immediately. Anyone else receives an email invitation, and the invitation appears under Membership Invites until they sign up with that email address.
Pending invitations show the invited email and roles. Select Cancel invitation to withdraw one. When an invitee signs up, every pending invitation for their email address is accepted at once. The person who sent the invitation gets an in-app notification, and the new member gets one naming their role.
Limits on invitations:
- One address can receive at most 5 invitations per day, across all organizations.
- One person can send at most 100 invitations per hour.
- Only one pending invitation per email address per organization.
- If the deployment has no email server configured, the invitation is still created but no email is sent.
Changing and removing members
Change a role from the role dropdown in the members table, then confirm in the Change organization role? or Change project role? dialog. Remove a member with the remove icon, or leave an organization yourself the same way. Removing a member from the organization removes their access to all of its projects.
The platform enforces these rules for every change:
- Who can manage members: members with User & role management access (Owner and Department Admin among the built-in roles). A custom role can split this into organization members, project members and invitations.
- No granting beyond your own access: you cannot invite or assign a role that grants any permission you do not hold yourself. A Department Admin therefore cannot make someone Security & Compliance or Owner.
- Role ranking: built-in roles rank Owner, Department Admin, Security & Compliance, Cost Analyst, Auditor, Manager Viewer, End User, None. You cannot assign, change or remove a role ranked above your own.
- No changing your own role: only an Owner can change their own role. Any member can leave an organization.
- Custom roles are Owner-assigned: assigning a custom role, at invitation or later, requires custom-role authoring access (Owner only) and the custom roles entitlement.
- At least one Owner: you cannot remove or demote the last Owner of an organization.
- Step-up verification: changing an organization or project role asks you to confirm your identity first. See Authentication & Security.
- Audit trail: invitations, role changes and removals are recorded in Audit Logs.
Other ways members are added
- SCIM provisioning: your identity provider can create users and set their organization role through the
rolesattribute, and push groups. See SCIM Provisioning. - Group role mappings: Okta and other identity provider groups map to built-in or custom roles, at organization or project scope. Roles are applied at every SSO sign-in and on every SCIM group change. See Group role mappings.
- Default organization and project: a self-hosted deployment can add every new user to a default organization and project with a set role (
LANGFUSE_DEFAULT_ORG_ID,LANGFUSE_DEFAULT_ORG_ROLE,LANGFUSE_DEFAULT_PROJECT_ID,LANGFUSE_DEFAULT_PROJECT_ROLE). The default role is End User. - Budget AI key invitations: when a Budget AI key is issued to someone by email with Also give them access to this project, they are added to the organization and project as End User (or invited, if they have no account) at the time the key link is created, unless they are already a member.
Next steps
- Custom Roles: build roles page by page.
- Access Control (RBAC): modules, access levels and separation of duties.
- Single Sign-On (SSO) and SCIM Provisioning: manage users from your identity provider.