> ## Documentation Index > Fetch the complete documentation index at: https://docs.portkey.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # User Roles & Permissions > Learn about Prisma AIRS AI Gateway's comprehensive role-based access control system across Organisations and Workspaces. The AI Gateway implements a comprehensive role-based access control (RBAC) system that operates across two main hierarchical levels: **Organisations** and **Workspaces**. This dual-layer approach ensures precise control over who can access what resources, enhancing security while enabling effective team collaboration. ## Organisation Level Organisations represent the highest level of structure within the AI Gateway. At this level, there are three distinct roles with varying levels of administrative control: > **Owner** > > The highest authority with complete control of the organisation > **Admin** > > Extensive administrative privileges across the organisation > **Member** > > Base-level organisation access, typically assigned to workspace roles ### Organisation Role Permissions | Capability | Owner | Admin | Member (without workspace) | | - | :-: | :-: | :-: | | Billing Management | | | | | Manage Organisation Settings | | | | | Create/Delete Workspaces | | | | | Manage Admin API Keys | | | | | Edit User Roles | | | | | Invite Organisation Users | | | | | Configure Access Permissions | | | | | Access to All Workspaces | | | | > [!NOTE] > > **Important**: Organisation Owners and Admins automatically receive Admin-level access to all workspaces within the organisation. All users must first be added as Organisation Members before they can be invited to any workspace. ## Workspace Level Workspaces are sub-organisational units that enable better team and project management. Each workspace maintains its own access control structure with three distinct roles: > **Admin** > > Complete control over workspace configuration and team management > **Manager** > > Administrative capabilities for team and resource management > **Member** > > Limited write access (own API keys, configs, prompts) with read-only access to other resources ### Workspace Role Permissions | Capability | Admin | Manager | Member | | - | :-: | :-: | :-: | | Invite Organisation Members to Workspace | | | | | Assign Workspace Roles (including Admin) | | | | | Update Workspace Settings | | | | | Create/Update/Delete Service API Keys | | | | | Create/Update/Delete User API Keys (own keys only for Members) | | | | | Create/Update Prompts | | | | | Publish/Delete Prompts | | | | | Create/Update/Delete Configs | | | | | Create/Update/Delete Guardrails | | | | | Create/Update/Delete Policies | | | | | Create/Update/Delete Providers | | | | | Create/Update/Delete Virtual Keys | | | | | View/List/Copy Virtual Keys | | | | | Create/Update/Delete MCP Servers | | | | | View/List MCP Servers | | | | | Create/Update/Delete Agent Servers | | | | | View/List Agent Servers | | | | | Create/Update Workspace Integrations | | | | | View Logs & Analytics | | | | | Export Logs & Analytics | | | | | View All Other Workspace Resources | | | | > [!NOTE] > > **Member Access**: Workspace Members can create, update, and delete their own **User API Keys**, **Configs**, and **Prompts** (except publish/delete). For all other resources, Members have read-only access. > [!WARNING] > > **API Key Privilege Escalation Prevention**: A user cannot modify an API key that carries permissions exceeding their own role. This is a security measure to prevent privilege escalation. If a legacy API key needs updating, an admin should retire it and create a new one with appropriately scoped permissions. ## Access Permission Configuration Organisation Owners and Admins can configure access permissions for various resources across workspaces. These settings determine what each role can access: > [!NOTE] > > By default Workspace Admins and Managers have the same permissions unless changed by Organisation Owner or Admin. > **[Logs Access Permissions](https://docs.portkey.ai/docs/aigw/product/administration/configure-logs-access-permissions-in-workspace.md)** > > Control which roles can view, filter, and export logs > **[Analytics Access Permissions](https://docs.portkey.ai/docs/aigw/product/administration/configure-analytics-access-permissions.md)** > > Control which roles can view analytics dashboards > **[Providers Access Permissions](https://docs.portkey.ai/docs/aigw/product/model-catalog.md)** > > Manage access to LLM providers for different roles > **[API Key Permissions](https://docs.portkey.ai/docs/aigw/product/administration/configure-api-key-access-permissions.md)** > > Configure API key creation and management rights > [!NOTE] > > **Key Workflow**: Users must first be added as organisation members before they can be invited to any workspace. Workspace admins and managers can then invite organisation members to their workspace and assign appropriate roles. ## Related Topics > **[Organisations](https://docs.portkey.ai/docs/aigw/product/enterprise-offering/org-management/organizations.md)** > **[Workspaces](https://docs.portkey.ai/docs/aigw/product/enterprise-offering/org-management/workspaces.md)** > **[API Keys (AuthN and AuthZ)](https://docs.portkey.ai/docs/aigw/product/enterprise-offering/org-management/api-keys-authn-and-authz.md)** > **[Access Control Management](https://docs.portkey.ai/docs/aigw/product/enterprise-offering/access-control-management.md)** ## Related topics - [API Keys (AuthN and AuthZ)](https://docs.portkey.ai/docs/aigw/product/enterprise-offering/org-management/api-keys-authn-and-authz.md) - [Workspaces](https://docs.portkey.ai/docs/aigw/product/enterprise-offering/org-management/workspaces.md) - [API Key Rotation](https://docs.portkey.ai/docs/aigw/product/enterprise-offering/org-management/api-key-rotation.md) - [Error AB03: You do not have enough permissions](https://docs.portkey.ai/docs/aigw/help-center/you-do-not-have-enough-permissions.md) - [Access Control Management](https://docs.portkey.ai/docs/aigw/product/enterprise-offering/access-control-management.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.