Skip to main content

Access Control

Taimoe Enterprise AI Gateway employs a Role-Based Access Control (RBAC) model, allowing organizations to manage fine-grained permissions for users and service accounts.

In the Aegis Console under GOVERNANCE → Access Control, administrators can inspect, grant, and revoke role bindings across organization and team scopes.

Enterprise SSO Banner​

At the top of the Access Control page, the platform displays the organization's single sign-on status:

  • SSO Active (Green Badge): Indicates Enterprise SSO authentication is active. Users must authenticate via your corporate Identity Provider (e.g., Microsoft Entra ID / Okta).
  • Setup Prompt: If SSO is not yet configured, a banner prompts administrators with a direct link to set up SSO under Workspace Settings → Authentication (SSO).

Core IAM Concepts​

IAM permission bindings connect three core elements:

  1. Principal: The user or identity requesting access (identified by enterprise email address).
  2. Scope: The target resource boundary where permissions apply:
    • Organization: Entire organization level.
    • Team: Specific team boundary.
    • Agent: Individual agent resource.
    • Platform: Platform-wide admin access.
  3. Role: A collection of permissions (e.g., Organization Admin, Team Admin, Project Editor, Viewer).

Granting Access​

To grant or modify permissions for users:

  1. Click "Grant Access" in the top right of the page to open the drawer.
  2. Complete the access binding fields:
    • New principals: Enter one or more user email addresses.
    • Scope (Resource Type): Select the target scope type (e.g., Organization or Team).
    • Resource: Select the specific organization or team resource instance.
    • Select a role: Select the desired role. The dropdown automatically filters roles applicable to the selected scope.
  3. Click "Save" to persist the binding.

Permission View & Inheritance​

The IAM table groups role bindings by Principal:

  • Direct Bindings: Permissions granted directly on the current scope (e.g., specific Team). These can be edited or revoked directly.
  • Inherited Bindings: Permissions inherited from an upper scope (e.g., Organization-level roles inherited down to a Team) are displayed in a read-only state with a lock icon. Inherited roles must be managed at the organization level.

Search, Filtering & Revocation​

Filtering Bindings​

  • Search: Enter an email address, user name, or role title to filter the table instantly.
  • Role Filter: Filter users by specific role categories.
  • Scope Type Filter: Filter bindings by resource scope type.

Revoking Access​

  • Single Binding Revocation: Expand a principal row and click the Delete (Trash) icon next to a specific role binding.
  • Bulk Revocation: Select multiple principals using checkboxes and click "Remove Selected" in the top toolbar to revoke permissions in bulk.