Role-Based Access Control

​

Overview of Role-Based Access Control

Fiddler supports Role-Based Access Control (RBAC) using resources and roles. This documentation outlines the resources, roles, and permissions available in Fiddler, enabling you to manage access control for your organization.

​

Understanding Resources

Resources are entities within Fiddler that users can access and interact with. There are two main resource types:

​

Organization Resources

• Organization: Represents your entire Fiddler setup, including projects and users.
• Settings: Organization-wide configuration, including general information, login details, credentials, the LLM Gateway, semantic mappings, MCP client setup, and notification integrations.
• Users: Individual users with accounts in your Fiddler organization.
• Teams: Groups of users within your organization.
  • Each user can be a member of zero or more teams.
  • Team roles are associated with project roles, i.e., teams can be granted
    Project Viewer, Project Writer, or Project Admin permissions for a project.
• Evaluators: Predefined and custom metrics used to assess model or application outputs.
• Global Agentic Custom Metrics: Organization-wide custom metrics for GenAI applications.
• Bookmarks: Saved shortcuts to frequently used projects, models, charts, and dashboards.

​

Project Resources

• Projects: Contain models, data, and configurations for a specific ML application.
• Models: Machine learning models onboarded to Fiddler for monitoring and explainability.
• Project Settings: Configurations related to project access and user permissions.
• Alerts: Notifications generated by Fiddler based on monitoring data.
• Charts & Dashboards: Visualizations of your model performance and data insights.
• Application: GenAI applications for agentic workflows.
• Evaluator Rules: Rules that define which evaluators run against application spans and how inputs are mapped.
• Project-Scoped Agentic Custom Metrics: Project-scoped custom metrics for GenAI applications.

​

Understanding Roles

Roles define the level of access a user has to Fiddler resources:

​

Organization Roles

• Org Admin: Manages users, teams, projects, and organization settings. Org Admins can view and delete any project in the organization, but cannot access a project’s contents — models, alerts, charts, dashboards, or applications — unless they created the project or a Project Admin has granted them a project role.
• Org Member: Limited access to organization settings and cannot create projects.
• Org Viewer: The most restricted organization role. On its own it grants no access to users, teams, projects, or most organization settings. Two things every role can read are the General settings tab and the MCP client setup. Any other access an Org Viewer has comes from project roles granted to them separately. Availability is limited — see Org Viewer and Project Dashboard Viewer below.
• Deactivated: Holds no permissions on any resource. Assigned to users whose access has been withdrawn without removing their account.

​

Org Admin Access to All Projects

By default, Org Admins cannot access the contents of projects they did not create. When this capability is enabled for your organization, Org Admins implicitly receive Project Admin permissions on every project, with no explicit project role assignment required. While this capability is enabled, Org Admins cannot be assigned an explicit project role — such requests return a 422 error, because their access is already implicit.

​

Project Roles

• Project Admin: Manages all aspects of a project, including models, settings, alerts, user access, and deleting the project. A project can only be deleted once it contains no models and no applications.
• Project Writer: Can view and edit most project resources (models, alerts, charts, dashboards), but cannot modify project-level settings, delete the project, or invite other users.
• Project Viewer: Can view project details and model content, but cannot edit anything except charts and dashboards (read-only access).
• Project Dashboard Viewer: Read-only access to the project’s charts and dashboards, and nothing else. This role can see the names of projects, models, and applications where they appear on those charts and dashboards, but cannot open those resources or view the project’s own details. Availability is limited — see Org Viewer and Project Dashboard Viewer below.

​

Org Viewer and Project Dashboard Viewer

Org Viewer and Project Dashboard Viewer belong to a capability that is turned off by default. The capability controls where the roles are offered, not how they behave — once assigned, each role works exactly as described above and in the permissions matrices below. While the capability is off, neither role appears in any role menu in the Fiddler UI, and identity provider group sync does not map users to Org Viewer. The REST API accepts both roles in either state, so a user can hold one even though it is not offered anywhere in the interface. When the capability is enabled:

• Org Viewer can be assigned when editing a user’s organization role, inviting a user, or adding a team member. It can also be granted through identity provider group sync, using a fiddler_org_viewer group or a custom mapper key — see Mapping IdP Groups to Teams.
• Project Dashboard Viewer can be assigned from a project’s access settings, either directly to a user or to a team.

​

Understanding Permissions

​

Permission types

Permission types are used in combination with resources and roles to define the access control rules in Fiddler. Fiddler’s RBAC access control uses the following permission types to define the level of access a user has to resources:

• List: This permission allows users to view a list of resources, but does not grant access to view details or interact with the resources in any way. For example, a user with the “List” permission for projects can see a list of project names, but cannot view project details or settings.
• Read: This permission enables users to view details of a resource, but does not grant access to edit or modify the resource in any way.
• Create: This permission allows users to create new resources, such as projects, models, or alerts.
• Update: This permission enables users to modify existing resources, such as updating project settings or editing model configurations. Permission errors returned by the API name this permission Update.
• Delete: This permission allows users to delete resources, such as deleting a project or a model.

​

Organization Level permissions

• Org Admin: Full access to organization settings and resources.
• Org Member: Limited access to organization settings.
• Org Viewer: No access to organization settings or resources, apart from reading the General settings tab and the MCP client setup.

Legend: ✅ = Granted ❌ = Not Granted N/A = Not Implemented

Resource	Role	List	Read	Create	Update	Delete
Settings / General	Admin	❌	✅	❌	✅	❌
	Member	❌	✅	❌	❌	❌
	Viewer	❌	✅	❌	❌	❌
Settings / Semantic Mappings, Email Configuration, PagerDuty Integration	Admin	❌	✅	✅	✅	✅
	Member	❌	❌	❌	❌	❌
	Viewer	❌	❌	❌	❌	❌
Settings / Webhook Integration	Admin	❌	✅	✅	✅	✅
	Member	❌	✅	❌	❌	❌
	Viewer	❌	❌	❌	❌	❌
Settings / LLM Gateway	Admin	❌	✅	✅	✅	✅
	Member	❌	✅	❌	❌	❌
	Viewer	❌	❌	❌	❌	❌
Settings / MCP	Admin	❌	✅	❌	❌	❌
	Member	❌	✅	❌	❌	❌
	Viewer	❌	✅	❌	❌	❌
Settings / Credentials (organization API keys)	Admin	❌	✅	✅	✅	✅
	Member	❌	❌	❌	❌	❌
	Viewer	❌	❌	❌	❌	❌
Settings / Credentials (your own API keys)	Admin	❌	✅	✅	✅	✅
	Member	❌	✅	✅	✅	✅
	Viewer	❌	❌	❌	❌	❌
Settings / Access / Teams & Invitations	Admin	❌	✅	✅	✅	✅
	Member	✅	✅	❌	❌	❌
	Viewer	❌	❌	❌	❌	❌
Settings / Access / Users	Admin	✅	✅	✅	✅	✅
	Member	❌	❌	❌	❌	❌
	Viewer	❌	❌	❌	❌	❌
Project (the project itself)	Admin	✅	✅	✅	✅	✅
	Member	❌	❌	❌	❌	❌
	Viewer	❌	❌	❌	❌	❌
Bookmarks	Admin	✅	✅	✅	✅	✅
	Member	✅	✅	✅	✅	✅
	Viewer	❌	❌	❌	❌	❌
Evaluators	Admin	❌	✅	✅	✅	✅
	Member	❌	✅	✅	✅	❌
	Viewer	❌	❌	❌	❌	❌
Global Agentic Custom Metrics	Admin	❌	✅	✅	N/A	✅
	Member	❌	✅	✅	N/A	❌
	Viewer	❌	❌	❌	N/A	❌

​

Project Level permissions

A user can be granted one of the following levels of access to an individual project, independently of their organization role.

• Project Admin: Full access to the resources inside a project, including deleting the project. Creating a new project is an organization-level permission held by Org Admin, not Project Admin.
• Project Writer: Limited access to project resources, excluding deletion and user invitation.
• Project Viewer: Read-only access to project resources.
• Project Dashboard Viewer: Read-only access to the project’s charts and dashboards only.

In the table below, the Project (the project itself) row governs the project object — viewing its details and settings, renaming it, or deleting it. Every other row governs a resource inside the project, such as a model, an alert, or a dashboard. Legend: ✅ = Granted ❌ = Not Granted N/A = Not Implemented

Resource	Role	Read	Create	Update	Delete
Project (the project itself)	Admin	✅	❌	✅	✅
	Writer	✅	❌	❌	❌
	Viewer	✅	❌	❌	❌
	Dashboard Viewer	❌	❌	❌	❌
Project / Models: Schema, Baseline, Dataset, Custom Metric, Segments	Admin	✅	✅	✅	✅
	Writer	✅	✅	✅	✅
	Viewer	✅	❌	❌	❌
	Dashboard Viewer	❌	❌	❌	❌
Project / Models / Artifacts	Admin	✅	✅	✅	✅
	Writer	✅	❌	❌	❌
	Viewer	❌	❌	❌	❌
	Dashboard Viewer	❌	❌	❌	❌
Project / Model / Alerts	Admin	✅	✅	✅	✅
	Writer	✅	✅	✅	✅
	Viewer	✅	❌	❌	❌
	Dashboard Viewer	❌	❌	❌	❌
Project / Charts	Admin	✅	✅	✅	✅
	Writer	✅	✅	✅	✅
	Viewer	✅	✅	✅	✅
	Dashboard Viewer	✅	❌	❌	❌
Project / Dashboards	Admin	✅	✅	✅	✅
	Writer	✅	✅	✅	✅
	Viewer	✅	✅	✅	✅
	Dashboard Viewer	✅	❌	❌	❌
Model Deployment	Admin	✅	✅	✅	✅
	Writer	✅	✅	✅	✅
	Viewer	✅	❌	❌	❌
	Dashboard Viewer	❌	❌	❌	❌
Application	Admin	✅	✅	✅	✅
	Writer	✅	✅	✅	✅
	Viewer	✅	❌	❌	❌
	Dashboard Viewer	❌	❌	❌	❌
Evaluator Rules	Admin	✅	✅	✅	✅
	Writer	✅	✅	✅	✅
	Viewer	✅	❌	❌	❌
	Dashboard Viewer	❌	❌	❌	❌
Project-Scoped Agentic Custom Metrics	Admin	✅	✅	N/A	✅
	Writer	✅	✅	N/A	❌
	Viewer	✅	❌	N/A	❌
	Dashboard Viewer	❌	❌	N/A	❌

​

Getting Started

• The default “Org Admin” role is created during Fiddler installation.
• Assign roles to users and teams to control access to resources.
• Use the permissions matrix to understand the access levels for each role.

Click here for more information on teams.