Admin access and permission matrix

Use this reference to identify the minimum access required for an Admin UI page. For help signing in or diagnosing missing access, start with Sign in and get the right access.

The server makes the final access decision. Seeing a page or button does not grant access to another organization or bypass an endpoint permission.

Page	Minimum access	What additional access controls	Reference
Dashboard	Platform administrator or spend.read	Totals include only authorized spending data	Spend API
Models	Any signed-in account	Creating, editing, and deleting require platform administrator access	Model deployments
Tiers	Platform administrator	All tier, version, capacity, and assignment changes	Tier API
Provider credentials	Platform administrator	Secret values remain hidden after they are saved	Provider credential API
Route groups	Platform administrator	Group, member, and routing-policy changes	Route-group API
Prompts	Platform administrator	Template, version, label, and binding changes	Administration API
MCP, Servers tab	Platform administrator or key.read	Changes require org.update for the affected organization	MCP API
MCP, Approvals tab	Platform administrator or key.update	Results are limited to the authorized scope	MCP approvals
Application keys	key.read, key.update, or eligible key.create_self	Ownership, team policy, and scope limit each action	Authentication
Organizations	Platform administrator or org.read	Changes require the relevant organization permission	Accounts and access
Teams	Platform administrator or team.read	Changes require the relevant organization or team permission	Accounts and access
People and permissions	Platform administrator	Accounts, invitations, and memberships affect platform access	Authentication
Usage and spending	Platform administrator or an enabled spending-reader role	Reports are limited to platform, organization, team, or personal scope	Budgets and spending
Workspace request logs	External customer session with spend.read.self	Rows are limited to the session's organization and selected team	Administration API
Audit logs	Platform administrator or audit.read	Results are limited to authorized scope	Audit records
Batch jobs	Platform administrator, or any organization or team membership	key.read shows all batches in that scope. Other members see only the batches they created, read-only. Cancel, retry, and replay require update access in the batch's scope	Batch Jobs page
Guardrails	Platform administrator	Definitions and assignments are platform administration actions	Guardrails
Playground	Any signed-in account	Requests require an application key allowed to use the selected model	Playground
Settings	Platform administrator	Changes affect the full installation	General settings

Permissions from platform, organization, and team roles are combined, but the server checks them again for the specific organization, team, key, or batch. For example, permission to update one organization does not allow changes to another.