Access Control
Copy page
Multi-tenant authentication with organizations, team management, and fine-grained project permissions
The Inkeep Agent Framework provides two layers of access control:
| Layer | What it does |
|---|---|
| Authentication | Users sign in, belong to organizations, manage teams |
| Authorization | Fine-grained project-level roles and permissions |
Authentication handles user sign-in and organization membership. Authorization adds granular control over who can do what within each project.
For deployment configuration including OAuth providers, see Authentication Setup.
Sign-In Methods
| Method | Description |
|---|---|
| Email & Password | Default sign-in with email and password credentials |
| OAuth sign-in (requires configuration) |
To add Google sign-in, see Adding OAuth Providers.
Organizations & Team Management
Each organization operates as an isolated tenant:
- Separate workspaces: Each organization has its own projects, agents, MCP servers, and credentials
- Team collaboration: Multiple users can belong to the same organization
- Role-based access: Team members have different permission levels
Organization Roles
| Role | Permissions |
|---|---|
| Admin | Full access to all projects and settings, can add members |
| Member | Access determined by project-level roles |
Inviting Team Members
- Go to Settings in the left sidebar
- View current members and their roles
- Click Invite to invite a new team member
- Enter the member's email and select a role (Admin or Member)
- Click Send Invitation
If email is enabled for your tenant, the invited user receives a branded email with a link to accept the invitation and set up their account. The invitation expires after 7 days.
If email is not configured, the invitation link is displayed directly in the UI — copy and share it manually with the team member.
For self-hosted deployments, email requires SMTP configuration. See Configure Email for setup instructions.
Password Reset
If email is enabled for your tenant, users can reset their password through a self-service flow:
- On the sign-in page, click Forgot password?
- Enter the email address associated with your account
- Check your inbox for a password reset link
- Click the link and set a new password
The reset link expires after a limited time. If you don't receive the email, check your spam folder.
If email is not configured for your tenant, contact your organization administrator to reset your password.
Project Roles & Permissions
Assign granular roles at the project level to give organization Members specific access to individual projects.
Role Hierarchy
| Role | View | Use | Edit |
|---|---|---|---|
| Project Admin | ✓ | ✓ | ✓ |
| Project Member | ✓ | ✓ | ✗ |
| Project Viewer | ✓ | ✗ | ✗ |
Permission Breakdown
| Permission | What it allows |
|---|---|
| View | See project configuration, agents, and settings (read-only) |
| Use | Invoke agents, create API keys, view traces |
| Edit | Modify agents, tools, credentials, project settings, and evaluations (datasets, evaluators, configs) |
Managing Project Members
- Navigate to your project
- Go to Members
- Search for members by email and select one or more to add
- Choose a role for the selected members and click Add
Organization Admins always have full access to all projects, regardless of project-level roles.
User-Scoped vs Project-Scoped Resources
Certain resources can be configured with different scopes:
| Scope | Description |
|---|---|
| Project-scoped | Shared across all users in the project |
| User-scoped | Configured separately for each user |
Example: MCP Servers
MCP servers can be configured as either project-scoped or user-scoped:
| Use Case | Recommended Scope |
|---|---|
| Shared company tools (internal APIs, databases) | Project-scoped |
| Personal integrations (user's Slack, GitHub, email) | User-scoped |
| Services requiring per-user authorization | User-scoped |
| Tools where data should be separated by user | User-scoped |
You only configure a user-scoped MCP server once. Each user sees the same server but connects with their own credentials. The framework automatically manages the per-user authentication.
To select the scope, go to MCP Servers → create a server → select the scope.
See MCP Servers for more details.