Permission management

Super administrator

A super administrator is one of the following account types:

• An Alibaba Cloud account. The upper-right corner of the Model Studio console displays the following:

  

• A RAM user with the AliyunBailianFullAccess (Model Studio administrator) system policy. This RAM user can use the Model Studio global management menu (China (Beijing) | Singapore | US (Virginia)) to grant almost all permissions to any RAM user (including themselves) for any region and any workspace. (Only an Alibaba Cloud account can grant OpenAPI permissions.)

  A RAM user is a sub-account created by an Alibaba Cloud account to securely assign cloud resources and permissions to team members.

  The upper-right corner displays the following:

  

A super administrator can use the Model Studio global management menu (China (Beijing) | Singapore | US (Virginia)) to manage multiple workspaces. These tasks include:

1. Create and rename workspaces.

2. Manage models and model rate limiting for all workspaces.

3. Manage accounts (users) for all workspaces.

4. Manage all API keys.

Workspace administrator

A workspace administrator is a RAM user who manages a workspace from its Permissions page.

The Administrator permission includes access to all pages within the workspace.

API key permissions

A single API key can belong to only one workspace and one user within a single region, and it cannot be transferred to other workspaces or users. The callable functions and model rate limiting for an API key are consistent with the permissions of its Workspace, and are not affected by console-level user permissions. You do not need to create different API keys for different models, such as text generation, text-to-image generation, or speech synthesis.

The following actions on an owner's account affect the API key's status:

In the Model Studio console, on the Permissions tab in the left navigation pane, you can grant a RAM user permission to create, delete, and view all API keys in the workspace.

OpenAPI permissions

By default, RAM users do not have permission to call the OpenAPI for Model Studio application features such as data, knowledge base, prompt engineering, and long-term memory.

To grant this permission, an Alibaba Cloud account must assign one of the following policies to the RAM user in the RAM console:

• AliyunBailianDataFullAccess: Allows the user to call all APIs in the Model Studio application's API catalog.

• AliyunBailianDataReadOnlyAccess: Allows the user to call read-only APIs in the Model Studio application's API catalog, such as DescribeFile - Query file status and GetIndexJobStatus - Query the status of a knowledge base creation job.

Set up a super administrator

Only an Alibaba Cloud account (root account) or a RAM user with the AliyunRAMFullAccess system policy can perform this operation.

1. Go to the RAM console and grant the RAM user the AliyunBailianFullAccess (Model Studio administrator) and AliyunBSSOrderAccess (for purchasing Alibaba Cloud subscription products) permissions.

2. After configuration, you can use Model Studio's global management menu (China (Beijing) | Singapore | US (Virginia)) to grant any permissions for any region and any workspace to any RAM user (including yourself), and purchase Model Studio subscription products.

Set up a workspace administrator

This operation requires a super administrator or a workspace administrator.

1. In the Model Studio console, go to the Permissions tab on the left-side navigation pane and grant the RAM user the Administrator permission.

   

Set model calling permissions

1. If you do not use the default workspace, ensure that the model calling permission is enabled for the specific model in the workspace. (This operation requires a super administrator.)

2. To call models from the Model Studio console, go to the Permissions tab on the left-side navigation pane and grant the RAM user the following permissions: (This operation requires a super administrator or a workspace administrator.)

   1. The ModelExperience-FullAccess permission to call models from the console.

   2. The BatchInference-FullAccess permission to use the batch inference feature.

   3. The ModelObservation-FullAccess permission to view the token consumption of model calls and evaluations.

   

3. To call models using the Model Studio API, create or assign an API key for the RAM user in the corresponding workspace. See API key permissions. (This operation requires a super administrator or a workspace administrator.)

Set console fine-tuning permissions

1. If you do not use the default workspace, ensure that the model fine-tuning (training) permission is enabled for the specific model in the workspace. (This operation requires a super administrator.)

2. In the Model Studio console, go to the Permissions tab on the left-side navigation pane and grant the RAM user the following model permissions: (This operation requires a super administrator or a workspace administrator.)

   1. The Playground-FullAccess permission to call fine-tuned models from the console.

   2. The ModelFine-tuning-FullAccess permission.

   3. The MyModels-FullAccess permission to manage model snapshots after fine-tuning is complete.

   4. The ModelDeployment-FullAccess permission to deploy fine-tuned models. You can call and evaluate a model only after you deploy it.

   5. The ModelEvaluation-FullAccess permission.

   6. The DataManagement-FullAccess permission to manage fine-tuning datasets.

   7. The ModelObservation-FullAccess permission to view the token consumption of model calls and evaluations.

Set API fine-tuning permissions

1. If you do not use the default workspace, ensure that the model fine-tuning (training) permission is enabled for the specific model in the workspace. (This operation requires a super administrator.)

2. Create or assign an API key for the RAM user in the corresponding workspace. See API key permissions. (This operation requires a super administrator or a workspace administrator.)