Skip to main content
Configure roles, permissions, and teams to control what users can do in your Adaptive deployment.
  • Permissions grant ability to perform actions (e.g., project:adapt allows fine-tuning)
  • Roles are named sets of permissions, assignable to users
  • Teams are groups with shared access to projects and resources
Users can belong to multiple teams with different roles in each.

Common operations

# Create a user
# teams_with_role takes a list of (team_key, role_key) tuples
adaptive.users.create(
    email="user@example.com",
    name="John Doe",
    teams_with_role=[("customer-support-team", "admin")]
)

# Create a service account (returns an API key for programmatic access)
result = adaptive.users.create_service_account(
    name="ci-bot",
    teams_with_role=[("customer-support-team", "inference")]
)
print(result.api_key)

# Add user to team
adaptive.users.add_to_team(
    email="user@example.com",
    team="customer-support-team",
    role="admin"
)

# Remove user from team
adaptive.users.remove_from_team(
    email="user@example.com",
    team="customer-support-team"
)

# Share project with team
# is_owner grants the team full control over the project, including resharing
adaptive.projects.share(
    project="project-to-share",
    team="customer-support-team",
    role="admin",
    is_owner=False
)

# Create a team
adaptive.teams.create(
    key="customer-support-team",
    name="Customer Support Team",
)

# Create a custom role
adaptive.roles.create(
    key="new-role",
    permissions=["project:read", "project:create"]
)

Admin team

The reserved admin team controls global operations. Some permissions behave differently depending on team membership:
  • Any team: list roles, list teams, list/update users in the same team
  • admin team only: create roles, create teams, add/remove users from any team
Users need both the right permission (via their role) and admin team membership to perform global operations. Seed admins are created once during initial deployment. Add email addresses to admins in values.yaml to bootstrap the first admin users:
auth:
  default_role: admin  # admin, platform-admin, power-user, read-only, inference, annotator
  default_team: default
  admins: []  # Email addresses for initial admins

Default roles

RoleKeyPermissions
AdminadminAll permissions. Creating teams/roles requires admin team membership.
Platform Adminplatform-adminadmin:manage_roles, admin:manage_teams, admin:manage_users, admin:manage_cluster, admin:demote_model. Requires admin team membership for create operations.
Power Userpower-userAll project:*, model:*, dataset:*, and remote_env:* permissions.
Read Onlyread-onlyAll read permissions: project:read, project:read_interactions, model:read, integration:read, remote_env:manage, project:judge_read, project:grader_read, project:custom_script_read, project:job_read.
InferenceinferenceRead-only permissions plus project:interact.
AnnotatorannotatorInference permissions plus project:read_interactions and project:add_feedback.

All permissions

Admin

PermissionDescription
admin:manage_rolesList roles (any team), create roles (admin team)
admin:manage_teamsList teams (any team), create teams (admin team)
admin:manage_usersList/update users in same team, global user management (admin team)
admin:manage_clusterManage cluster configuration (admin team)
admin:demote_modelDemote models (admin team)

Project

PermissionDescription
project:readView project details
project:createCreate projects
project:updateUpdate project details
project:manage_modelsAttach/detach models to projects
project:adaptTrain models
project:evaluateEvaluate models
project:interactChat with models
project:add_feedbackAdd interaction feedback
project:read_interactionsView logged interactions
project:update_interactionsUpdate interaction metadata
project:delete_interactionsDelete logged interactions
project:shareShare project with another team. Requires membership in both the project’s current team and the target team.
project:monitoring_reportView monitoring reports
project:judge_createCreate judges
project:judge_readView judges
project:judge_updateUpdate judges
project:grader_createCreate graders
project:grader_readView graders
project:grader_updateUpdate graders
project:grader_deleteDelete graders
project:tool_provider_createCreate tool providers
project:tool_provider_updateUpdate tool providers
project:tool_provider_deleteDelete tool providers
project:interactive_job_createCreate interactive jobs
project:job_createCreate jobs
project:job_readView jobs
project:job_updateUpdate jobs
project:job_cancelCancel jobs
project:job_deleteDelete jobs
project:custom_script_createCreate custom scripts
project:custom_script_readView custom scripts
project:custom_script_updateUpdate custom scripts
project:custom_script_deleteDelete custom scripts
project:metric_createCreate metrics
project:metric_updateUpdate metrics
project:metric_deleteDelete metrics

Resources

PermissionDescription
dataset:createCreate datasets
model:readView models
model:manage_modelsDeploy/terminate models globally (admin team)
model:publishPublish models
team:manageUpdate users in same team

Integrations

PermissionDescription
integration:readView integrations
integration:createCreate integrations
integration:updateUpdate integrations
integration:deleteDelete integrations

Remote environments

PermissionDescription
remote_env:manageManage remote environments