Skip to main content
TrueFoundry offers custom roles to be assigned to users with scoped permissions in the platform. These roles allow fine-grained access control over various resources and actions. Key aspects of custom roles:
  1. Each role can have multiple permissions across different resource types
  2. Permissions define what actions can be performed on specific resources
  3. Roles can be assigned to users to grant them the associated permissions

​
Available Permissions

​
AI Gateway

PermissionDescription
Create Provider AccountAllows creation of new provider accounts
Delete Provider AccountAllows deleting existing provider accounts
Manage Provider AccountAllows updating provider account configuration
Read Provider AccountAllows viewing provider account details
Use IntegrationsAllows using integrations associated with provider accounts
PermissionDescription
Create MCP ServerAllows creation of new MCP servers
Delete MCP ServerAllows deleting existing MCP servers
Manage MCP ServerAllows updating MCP server configuration
Read MCP ServerAllows viewing MCP server details
Use MCP ServerAllows using MCP server for operations
PermissionDescription
Create AgentAllows creation of new Agents
Delete AgentsAllows deleting existing Agents
Manage AgentsAllows updating Agents
Read AgentsAllows viewing Agents details
PermissionDescription
List Gateway ControlsAllows listing and viewing gateway controls
Manage Gateway ControlsAllows creating, updating, and deleting gateway controls

​
AI Engineering

PermissionDescription
Create ClusterAllows creation of new clusters
Delete ClusterAllows deleting existing clusters
Manage ClustersAllows updating and configuring cluster settings
Read ClusterAllows viewing cluster details and configuration
PermissionDescription
Create WorkspaceAllows creation of new workspaces
Delete WorkspaceAllows deleting existing workspaces
Manage WorkspaceAllows updating workspace configuration
Read WorkspaceAllows viewing workspace details
List WorkspacesAllows listing and viewing all workspaces
PermissionDescription
List ApplicationsAllows listing and viewing applications
Manage ApplicationsAllows creating, updating, and deleting applications
PermissionDescription
List EnvironmentsAllows listing and viewing environments
Manage EnvironmentsAllows creating, updating, and deleting environments
PermissionDescription
List PoliciesAllows listing and viewing policies
Manage PoliciesAllows creating, updating, and deleting policies

​
Common

PermissionDescription
List RolesAllows listing and viewing roles
Manage RolesAllows creating, updating, and deleting roles
PermissionDescription
List UsersAllows listing and viewing users
Manage UsersAllows creating, updating, and deleting users
PermissionDescription
Create TeamAllows creation of new teams
Delete TeamAllows deleting existing teams
Manage TeamAllows updating team configuration and members
Read TeamAllows viewing team details and members
PermissionDescription
Create Virtual AccountAllows creation of new virtual accounts
Read Virtual AccountAllows viewing virtual account details
Manage Virtual AccountAllows updating virtual account configuration and tokens
Delete Virtual AccountAllows deleting existing virtual accounts
PermissionDescription
List External IdentitiesAllows listing and viewing external identities
Manage External IdentitiesAllows creating, updating, and deleting external identities
PermissionDescription
Create Provider AccountAllows creation of new provider accounts
Delete Provider AccountAllows deleting existing provider accounts
Manage Provider AccountAllows updating provider account configuration
Read Provider AccountAllows viewing provider account details
Use IntegrationsAllows using integrations associated with provider accounts
PermissionDescription
Create RepositoryAllows creation of new repositories
Delete DataAllows deleting data within repositories
Delete RepositoryAllows deleting existing repositories
Manage RepositoryAllows updating repository configuration
Read DataAllows reading data from repositories
Read RepositoryAllows viewing repository details
Write DataAllows writing data to repositories
PermissionDescription
Create Secret GroupAllows creation of new secret groups
Delete Secret GroupAllows deleting existing secret groups
Manage Secret GroupAllows updating secret group configuration
Read DataAllows reading secret values
Read Secret GroupAllows viewing secret group details
Write DataAllows writing or updating secret values
PermissionDescription
List SettingsAllows listing and viewing platform settings
Manage SettingsAllows updating platform settings

​
Managing Default Roles

TrueFoundry allows customizing default roles for giving flexibility to Admins to decide. For example, we can update the Default team manager role to allow them manage their virtual accounts on their own.
Updating permissions for Admin role is not allowed and by default contains all the permissions.

​
Managing Custom Roles

Manage custom roles with fine-grained permissions on different resources at tenant level. These custom roles can then be assigned to Users.
1

Create new Custom Role

Navigate to Access > Roles > Custom Roles. Click on Create Role.
2

Fill the form

​
Name
string
required
A unique name to identify this role. Should follow the format as Alphanumeric characters and hyphens.
​
Display Name
string
required
A user-friendly readable display name for this Role.
​
Description
string
required
A breif description about this role and its permissions.
​
Permissions
array
required
Permissions for the role. Refer to Available Permissions to understand these Permissions.
  • Permissions are applied to all the resources in the tenant.
  • Provider Account should be used to give permissions for Models, Guardrails, and Integrations.
3

Assign Roles to user

Navigate to Access > Users. Select the user and click on Edit User.
Select the role and Save Changes.
User can be assigned to only one role at a time.

​
FAQ

You can achieve this by updating the default role for Team Manager to allow them to create or manage their Virtual Account.
1

Edit default Team Manager Role

Navigate to Access > Roles > Default Roles and click on Edit button for the default Team Manager role.
2

Update Team Manager role

Update the permissions based on your requirements.
  • Read Virtual Account: If you want to allow Team Managers view Virtual Accounts owned by their teams.
  • Create Virtual Account: If you want to allow Team Managers create new Virtual Accounts owned by their teams.
  • Manage Virtual Account: If you want to allow Team Managers update Virtual Accounts owned by their teams. This also includes permission to get the token.
  • Delete Virtual Account: If you want to allow Team Managers delete Virtual Accounts owned by their teams.
These permissions apply to all the Team Managers in the Account irrespective of their Teams.
3

Manage Virtual Accounts

Team Managers should now be able to view, create, manage or delete Virtual Account owned by their Team based on the permissions given.
You can achieve this by assigning a custom role to those Users to allow them to create or manage their Virtual MCP Servers.
1

Create a new Custom Role

Navigate to Access > Roles > Custom Roles and click on Create Role button.
2

Fill the form

Fill the form with required details and add Create MCP Server permission to allow just create a new MCP/Virtual MCP Server.
This only allows the Users to create a new MCP Server. They cannot view or update any existing MCP Server in the Account through this permission. User can add themself as MCP Server Manager using collaborator to update and access the MCP Server while creating it first time.
3

Assing the Role to User

Navigate to Access > Users and click Edit for users to allow creating MCP Servers. Assign the created Role.
You can achieve this by editing the default Member role to allow them to view Gateway Controls.
1

Edit default Team Manager Role

Navigate to Access > Roles > Default Roles and click on Edit button on Member role.
2

Update Team Manager role

Update the permissions to add List Gateway Controls and click Update to allow all the Users in the Account view all the Gateway Configs.
This allows all the Users access to view all the Gateway Controls by default.