RBAC & Permissions

RI Platform uses workspace membership, role-based administration, and scoped API access to control what users and integrations can do.

Permissions are enforced by backend services. This means access control does not rely only on whether a page, button, or menu item is visible in the interface.

Access control model

Reliable Insights separates access into several layers:

• Authentication - Confirms who the user is.
• Workspace membership - Controls which workspaces the user can access.
• Workspace roles - Controls which administrative actions the user can perform.
• Feature availability - Controls which product capabilities are enabled for the workspace.
• API key scopes - Controls what programmatic integrations are allowed to do.

This layered approach helps customers manage access using the principle of least privilege. Users and integrations should only receive the access they need for their role or workflow.

Workspace membership

Workspaces are the main administrative and security boundary within RI Platform.

A user must be a member of a workspace before they can access that workspace’s resources. Workspace-scoped resources can include:

• Studio datasets and experiments.
• Pipeline datasources, feeds, deployments, and results.
• RI Connect API keys and API-created resources.
• Workspace subscription and usage information.
• Workspace member settings.

Data and resources are associated with the workspace where they were created.

For more information about the workspace model, see Workspaces.

Role-based administration

Administrative actions are protected by workspace roles.

Depending on the action, RI Platform may require the user to have an Owner or Admin role before they can make workspace-level changes.

Examples of administrative actions can include:

• Inviting or managing workspace members.
• Updating workspace settings.
• Managing datasources.
• Managing API keys.
• Accessing billing-sensitive actions.
• Managing workspace-level privileges or resources.

Role checks help ensure that users can perform ordinary workspace tasks without automatically receiving administrative control over the workspace.

Backend-enforced permissions

RI Platform enforces permissions on the backend.

The user interface may hide or disable actions that a user cannot perform, but backend services remain the source of truth for whether an action is allowed.

This helps protect workspace resources from:

• Direct endpoint access.
• Modified URLs.
• Bypassed interface flows.
• Unauthorised automated requests.
• Attempts to access data outside the user’s workspace permissions.

API key permissions

API keys are used for programmatic access to the Reliable Insights Platform API.

API keys are created within a workspace and are intended to access resources belonging to that workspace. This helps keep integrations scoped to the environment, team, project, or customer workflow they were created for.

API keys use scopes to control what actions the key is allowed to perform. Scopes help customers avoid giving every integration broad access.

For example, an ingestion workflow may need permission to write incoming data, but it may not need permission to read model results or manage datasources.

Least-privilege API access

Customers should create API keys with only the scopes required for the integration.

Recommended practices include:

• Use separate API keys for separate integrations.
• Use separate keys for development, testing, and production workflows.
• Give each key a clear name that describes its purpose.
• Grant only the scopes required for that workflow.
• Set an expiry date where appropriate.
• Rotate keys according to internal security policy.
• Revoke keys that are no longer needed.

API keys should be treated like passwords or other sensitive credentials. They should not be committed to source control, shared in screenshots, or hardcoded into application code.

For more information, see RI Connect API Keys.

Subscription and feature access

Some permissions are affected by the workspace subscription and enabled features.

A user may have access to a workspace, but the workspace must also have the relevant feature enabled before that feature can be used. This can apply to areas such as Studio, Pipeline, RI Connect, user seats, storage, and usage-based credits.

This separates user permissions from workspace entitlements:

• User permissions control what a person can do inside a workspace.
• Workspace entitlements control what the workspace has access to.

For more information, see Subscriptions.

Customer responsibilities

Customers are responsible for assigning access carefully.

Recommended practices include:

• Invite only users who need access to a workspace.
• Assign administrative roles only where required.
• Review workspace membership regularly.
• Remove users promptly when access is no longer needed.
• Use separate workspaces for separate teams, customers, environments, or workflows.
• Use separate API keys for separate integrations.
• Revoke API keys that are no longer needed.
• Review datasource, integration, and API key activity regularly.

How this supports secure administration

RBAC and permission controls help customers administer RI Platform securely by:

• Keeping users and resources scoped to the correct workspace.
• Protecting administrative actions with role checks.
• Separating ordinary access from workspace administration.
• Limiting API integrations through scopes.
• Supporting least-privilege access for users and systems.
• Allowing access to be removed when users or integrations no longer need it.

These controls help make access intentional, reviewable, and easier to manage across teams, projects, customers, and environments.