MLflow 3.13 introduces Role-Based Access Control (RBAC) to address permission management challenges in LLM teams. Instead of per-resource explicit permission calls, teams can now define reusable roles with resource patterns (e.g., EDIT on all prompts), assign users to roles, and isolate teams using workspaces. Four permission levels exist: READ, USE, EDIT, and MANAGE. The system supports three user tiers: Platform Admin, Workspace Manager, and Regular User. Legacy per-resource permissions from pre-3.13 are removed, with DB migration handling backfill. Direct per-resource grants remain available for one-off scenarios. The post includes a full AuthServiceClient API reference and setup walkthrough.
Table of contents
Traditional permissions fall short for LLM Teams What RBAC provides Getting Started - Creating Roles and Assigning Them Isolate Different Teams on One MLflow Server User Tiers Migrating from Legacy Permissions (Pre-3.13) How Permission Resolution Works Reference: AuthServiceClient Methods The Bigger Picture 2.2K Impressions