Manage User Roles & Permissions

Documentation Index

Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt

Use this file to discover all available pages before exploring further.

1. Resource-level roles — assigned directly on a specific resource (cluster, workspace, model, MCP server, etc.) as collaborators. These roles control what a user, team, or virtual account can do on that particular resource.
2. Tenant-level roles — assigned globally to a user or team within the tenant. These roles define what actions the identity can perform across all resources of that type in the tenant.

​

Resource-level roles (collaborators)

​

Tenant-level roles

​

Assign a role to a user

• Admin — Full control over the tenant, including users, teams, clusters, workspaces, models, MCP servers, and all other resources. Usually only a few admins per organization.
• Member — General platform user. By default, members do not have access to any resources and must be granted access explicitly through resource collaborators or team membership.

​

Assign a role from the UI

​

Assign a role through team membership

​

Available platform permissions

​

AI Gateway

​

AI Engineering

​

Common

​

Managing Default Roles

​

Managing Custom Roles

1

Create new Custom Role

Navigate to Access > Roles > Custom Roles. Click on Create Role.

2

Fill the form

​

Name

string

required

A unique name to identify this role. Should follow the format as Alphanumeric characters and hyphens.

​

Display Name

string

required

A user-friendly readable display name for this Role.

​

Description

string

required

A breif description about this role and its permissions.

​

Permissions

array

required

Permissions for the role. Refer to Available platform permissions to understand these permissions.

• Permissions are applied to all the resources in the tenant.
• Provider Account should be used to give permissions for Models, Guardrails, and Integrations.

Example for read-only Platform User

3

Assign the role to a user or team

Assign to a user: Navigate to Access > Users. Select the user, click Edit User, select the role, and save.

Assign to a team: Navigate to Access > Teams. Select the team, click Edit Team, select the role, and save. Every member of the team inherits the permissions from that role.

A user can be assigned only one tenant-level role directly. If the user is also a member of a team with a role, the effective permissions are the union of both.

​

FAQ

How to allow Teams create and manage their Virtual Accounts without making them Admin?

You can achieve this by updating the default role for Team Manager to allow them to create or manage their Virtual Account.

1

Edit default Team Manager Role

Navigate to Access > Roles > Default Roles and click on Edit button for the default Team Manager role.

2

Update Team Manager role

Update the permissions based on your requirements.

• Read Virtual Account: If you want to allow Team Managers view Virtual Accounts owned by their teams.
• Create Virtual Account: If you want to allow Team Managers create new Virtual Accounts owned by their teams.
• Manage Virtual Account: If you want to allow Team Managers update Virtual Accounts owned by their teams. This also includes permission to get the token.
• Delete Virtual Account: If you want to allow Team Managers delete Virtual Accounts owned by their teams.

These permissions apply to all the Team Managers in the Account irrespective of their Teams.

3

Manage Virtual Accounts

Team Managers should now be able to view, create, manage or delete Virtual Account owned by their Team based on the permissions given.

How to allow Users create and manage their Virtual MCP Servers without making them Admin?

You can achieve this by assigning a custom role to those Users to allow them to create or manage their Virtual MCP Servers.

1

Create a new Custom Role

Navigate to Access > Roles > Custom Roles and click on Create Role button.

2

Fill the form

Fill the form with required details and add Create MCP Server permission to allow just create a new MCP/Virtual MCP Server.

This only allows the Users to create a new MCP Server. They cannot view or update any existing MCP Server in the Account through this permission. User can add themself as MCP Server Manager using collaborator to update and access the MCP Server while creating it first time.

3

Assing the Role to User

Navigate to Access > Users and click Edit for users to allow creating MCP Servers. Assign the created Role.

How to allow all Users to view Gateway Controls like Rate limit, Routing config, etc without making them Admin?

You can achieve this by editing the default Member role to allow them to view Gateway Controls.

1

Edit default Team Manager Role

Navigate to Access > Roles > Default Roles and click on Edit button on Member role.

2

Update Team Manager role

Update the permissions to add List Gateway Controls and click Update to allow all the Users in the Account view all the Gateway Configs.

This allows all the Users access to view all the Gateway Controls by default.

What are the permissions given to a Member role by default?

Default Member role comes with following permissions:

• settings:ListSettings
• repository:CreateRepository
• secret-group:CreateSecretGroup
• user:ListUsers