Roles and permissions
Five roles, eleven permissions, and the global administrator
A user has one role per tenant. The same person can be a DEVELOPER in tenant A and a VIEWER in tenant B.
Roles
| Role | For | In one line |
|---|---|---|
| VIEWER | People who only look at results | Every screen, read-only |
| DEVELOPER | ML engineers, data staff | Datasets, training, experiments, model registration, up to Staging |
| OPERATOR | Operations staff | What DEVELOPER does + deployment, serving, alert handling, pipelines |
| APPROVER | Quality or operations owners | View + approve or reject, promote to Production |
| ADMIN | Tenant administrators | Every permission + members, tokens, tenant settings, rollback |
Permission table
| Permission | What it allows | VIEWER | DEVELOPER | OPERATOR | APPROVER | ADMIN |
|---|---|---|---|---|---|---|
| View | View every screen read-only | ✅ | ✅ | ✅ | ✅ | ✅ |
| DevelopDEVELOPER · OPERATOR · ADMIN | Create training runs, log and stop runs, issue MLflow tokens | ✅ | ✅ | ✅ | ||
| Register modelDEVELOPER · OPERATOR · ADMIN | Register a run's result as a new model version | ✅ | ✅ | ✅ | ||
| Promote to StagingDEVELOPER · OPERATOR · ADMIN | Move a model version between stages such as Staging and Archived | ✅ | ✅ | ✅ | ||
| Promote to ProductionAPPROVER · ADMIN | Request promotion to Production (it takes effect after approval). Taking a live Production version down also needs this permission | ✅ | ✅ | |||
| ApproveAPPROVER · ADMIN | Approve or reject promotion requests | ✅ | ✅ | |||
| DeployOPERATOR · ADMIN | Deploy and serve models, build serving images | ✅ | ✅ | |||
| OperateOPERATOR · ADMIN | Operational actions: acknowledge and resolve alerts, run and stop pipelines, delete training runs | ✅ | ✅ | |||
| Roll backADMIN | Roll a deployment back to a previous version | ✅ | ||||
| Write datasetsDEVELOPER · OPERATOR · ADMIN | Create datasets, upload and delete files | ✅ | ✅ | ✅ | ||
| SettingsADMIN | Manage members, tokens and tenant settings in the admin console | ✅ |
Global administrator
Global administrator status is granted separately from tenant roles. It creates and deletes tenants, manages every user and uses the system console (cluster, GPUs, build cache, weights mirror, Prometheus and so on). A global administrator can access every tenant and is not subject to tenant permission checks. It is a powerful account — give it only to those who need it.
Example flow — promoting to Production
- A DEVELOPER trains a model; its version is registered and moved to Staging. They summarise the validation results for the approvers.
- An APPROVER (or ADMIN) presses Request production promotion on the model version and enters a reason. The version does not become Production yet — an approval request is created and appears under Approvals (승인).
- Someone with the approve permission reviews it and presses Approve: the version becomes Production and the previous Production version moves to Archived. Reject notifies the requester with the reason.