Roles and permissions
Roles, permissions, and the global administrator
A user has one role per tenant. The same person can be a DEVELOPER in tenant A and a VIEWER in tenant B.
Roles
| Role | For | In one line |
|---|---|---|
| VIEWER | People who only look at results | Every screen, read-only |
| DEVELOPER | ML engineers, data staff | Datasets, training, experiments, model registration, up to Staging |
| OPERATOR | Operations staff | What DEVELOPER does + deployment, serving, alert handling, pipelines |
| APPROVER | Quality or operations owners | View + approve or reject, promote to Production |
| ADMIN | Tenant administrators | Every permission + members, tokens, tenant settings, rollback |
Permission table
| Permission | What it allows | VIEWER | DEVELOPER | OPERATOR | APPROVER | ADMIN |
|---|---|---|---|---|---|---|
| View | View every screen read-only | ✅ | ✅ | ✅ | ✅ | ✅ |
| DevelopDEVELOPER · OPERATOR · ADMIN | Create training runs, log and stop runs, issue MLflow tokens | ✅ | ✅ | ✅ | ||
| Register modelDEVELOPER · OPERATOR · ADMIN | Register a run's result as a new model version | ✅ | ✅ | ✅ | ||
| Promote to StagingDEVELOPER · OPERATOR · ADMIN | Move a model version between stages such as Staging and Archived | ✅ | ✅ | ✅ | ||
| Promote to ProductionAPPROVER · ADMIN | Request promotion to Production (it takes effect after approval). Demoting a live Production version also needs this permission | ✅ | ✅ | |||
| ApproveAPPROVER · ADMIN | Approve or reject promotion requests | ✅ | ✅ | |||
| DeployOPERATOR · ADMIN | Deploy and serve models, build serving images | ✅ | ✅ | |||
| OperateOPERATOR · ADMIN | Operational actions: acknowledge and resolve alerts, run and stop pipelines, delete training runs | ✅ | ✅ | |||
| Roll backADMIN | Record a deployment as rolled back (devices must pull the previous version again; see Roll back a deployment) | ✅ | ||||
| Write datasetsDEVELOPER · OPERATOR · ADMIN | Create datasets, upload and delete files | ✅ | ✅ | ✅ | ||
| SettingsADMIN | Manage members, tokens and tenant settings in the admin console | ✅ |
Global administrator
Global administrator status is granted separately from tenant roles. It creates and deletes tenants, manages every user and uses the system console (cluster, GPUs, build cache, weights mirror, Prometheus and so on). A global administrator can access every tenant. In tenants where they are not a member they act as ADMIN; where they hold a direct membership, that membership's role applies. Grant it only to those who need it.
Example flow — promoting to Production
- A DEVELOPER registers the training result as a model version (automatically from the wizard, or from Experiments (실험)). New versions go to Staging. They summarise the validation results for the approvers.
- An APPROVER (or ADMIN) presses Request production promotion on the model version and enters a reason. The version does not become Production yet — an approval request is created and appears under Approvals (승인).
- Someone with the approve permission reviews it and presses Approve: the version becomes Production and the previous Production version moves to Archived. Reject notifies the requester with the reason.