Skip to main content

Users & Access Control

AgentMark uses a role-based access control (RBAC) system with granular permissions at the organization and app level.

Built-in Roles

Every organization member is assigned one of these roles:
RoleAccess
OwnerFull access. Assigned to the org creator. Can transfer ownership.
AdminFull access to all org resources, settings, billing, and member management.
WriteRead and write access to apps, prompts, traces, experiments, and datasets. Cannot manage members or billing.
ReadRead-only access to all org resources. Cannot create, edit, or delete anything.

Inviting Members

Invite team members from Settings > Members in the Dashboard. Invitations are sent by email and expire after 7 days. Each invitation includes a role assignment.

Custom Roles

Team tier and above. Custom roles require a Team or Enterprise subscription.
Create custom roles with cherry-picked permissions for fine-grained access control:
  1. Navigate to Settings > Roles in the Dashboard
  2. Click Create Role
  3. Name the role and select the specific permissions to grant
  4. Assign the role to members
Custom roles draw from the full permission catalog — you can grant access to specific features (e.g., “can view traces and run experiments but cannot edit prompts or manage billing”).

App-Level Roles

Team tier and above. App-level roles require a Team or Enterprise subscription.
Assign different roles per app within the same organization. A member might have Write access to your staging app but Read access to production. Configure app-level roles from the app’s Settings > Members page.

API Keys

API keys are scoped to individual apps. Each key grants access only to that app’s resources (prompts, traces, experiments).
  • Create and manage keys from Settings > API Keys in the Dashboard
  • Keys are rate-limited by tier (see Billing & Usage for limits)
  • Key names must be unique within an app

SSO Enforcement

Enterprise organizations can enforce SAML SSO for all members. When SSO enforcement is enabled, members must authenticate through your identity provider — no password fallback is available. See Security & Compliance for SSO configuration details.

Have Questions?

We’re here to help! Choose the best way to reach us: