Permission management

Alibaba Cloud Model Studio provides granular access control at the console and model levels to support complex organizational structures spanning multiple regions.

Alibaba Cloud Model Studio identity management

A workspace is the smallest management unit for fine-grained permission control over models and users, and for Alibaba Cloud cost allocation.

Model Studio uses three roles to manage workspace permissions:

1. Super administrator: Manages user permissions, available models, model rate limiting, and API keys across multiple workspaces.
2. Workspace administrator: Manages user permissions and resources within a specific workspace.
3. Regular user: Uses authorized resources.

Workspace permissions	Super administrator (with the AliyunBailianFullAccess system policy)	Workspace administrator	Regular user
Manage model calls and rate limiting	Supported	Not supported	Not supported
Manage model fine-tuning	Supported	Not supported	Not supported
Manage model deployment	Supported	Not supported	Not supported
User management	Supported	Supported	Not supported
Manage user page access	Supported	Supported	Not supported
API key management	Supported	Supported	Not supported
Use authorized workspaces, pages, and resources	Supported	Supported	Supported
OpenAPI permissions	Not supported	Not supported	Not supported

Super administrator

Super administrators include the following two types of accounts:

• The Alibaba Cloud account. You can identify it in the upper-right corner of the Model Studio console:

  Click the profile icon to open the account drop-down panel. The entry with the Alibaba Cloud account label is the super administrator account.

• A RAM user (account) with the AliyunBailianFullAccess (Model Studio administrator) system policy. In the upper-right corner of the Model Studio console, click the profile icon to open the account drop-down panel and view the account information of the currently logged-on RAM user. This RAM user can use the Global Management menu of Model Studio (China (Beijing) | Singapore | US (Virginia) | Germany (Frankfurt)) to grant almost all permissions for any region and any workspace to any RAM user (including themselves). (Only the Alibaba Cloud account can add OpenAPI permissions and China (Hong Kong).)

  A RAM user is a sub-account created by an Alibaba Cloud account to securely delegate permissions for cloud resources to team members.

Super administrators can use Model Studio's global management menu (China (Beijing) | Singapore | US (Virginia) | Germany (Frankfurt) | China (Hong Kong)) to manage multiple workspaces. The features include:

1. Create and rename workspaces.
2. Manage models and model rate limiting across all workspaces.
3. Manage accounts (users) for all workspaces.
4. Manage all API keys.
5. Turn on the input detection/output detection switches of the AI guardrail for each business space in Workspace Management (available only in the China (Beijing) region).
6. Manage workspaces (create, query, and delete workspaces, and configure model authorization and rate limiting) by using the ModelStudio OpenAPI.

Workspace administrator

A workspace administrator is an Alibaba Cloud RAM user who manages a specific workspace through the Permission Management page of that workspace.

The Administrator permission grants access to all pages within the workspace.

In the Edit Permissions dialog box, click the Other tab, select Administrator from the list of permissions, and then click OK.

Workspace permission management

Model Studio organizes resources and workspaces by region. A single workspace cannot span multiple regions. Even the default workspaces in different regions are distinct entities. Click to go to the global management menu (Beijing | Singapore | Virginia | Frankfurt | China (Hong Kong)).

A workspace in Model Studio is the smallest administrative unit for fine-grained permission management, allowing you to manage:

Workspace permissions	Super administrator (with the AliyunBailianFullAccess system policy)	Workspace administrator	Regular user
Manage model calls and rate limiting	Supported	Not supported	Not supported
Manage model fine-tuning	Supported	Not supported	Not supported
Manage model deployment	Supported	Not supported	Not supported
User management	Supported	Supported	Not supported
Manage user page access	Supported	Supported	Not supported
API key management	Supported	Supported	Not supported
Use authorized workspaces, pages, and resources	Supported	Supported	Supported
OpenAPI permissions	Not supported	Not supported	Not supported

• Restrict model calls: Manage whether a model can be called (from the console or via an API) and configure the model's Request Number Limit and Token Limit.

  This restriction does not apply to the default workspace, where all models can be called without any throttling.

  In the model list, use the toggle in the Model Calling column to control the model's authorization status. In the Current Workspace Limit column, set the request number limit and token limit values and their time units (1, 2, 3, 5, 10, 30, and 60 seconds are supported). If no rate limit is set, the workspace shares the account-level total rate limit quota.

• Restrict model fine-tuning: Manage whether a model can be fine-tuned (from the console or via an API) and subsequently deployed within the workspace.

  This restriction does not apply to the default workspace. There, all models that support fine-tuning can be fine-tuned and then deployed.

  On the Model List tab of the workspace, find the target model. In the Model Authorization area, use the toggle in the Model Training column to control the model's fine-tuning permission.

• Restrict model deployment: Manage whether a model can be deployed directly.

  This restriction does not apply to the default workspace, where all models that support deployment can be deployed.

  On the Model List tab, the Model Deployment column in the Model Authorization area shows the deployment authorization status for each model. Use the toggle to switch the status between Authorized and Unauthorized.

• Manage console permissions for users (accounts): Control whether a RAM user can use the features of the workspace console and which features they can use. Console page permissions do not affect model calls made by the user through an API key (the permissions of an API key are determined by the model authorizations of the workspace it belongs to).

  An Alibaba Cloud account does not require this setting and has access to all pages in all workspaces.

  In the Edit Permissions dialog box, select the Model tab. In the permission list, find and select the Model Experience - Operations permission. The Experience Center menu in the left navigation pane corresponds to the Model Experience - Operations permission in the list.

API key permissions

A single API key can only belong to one workspace and one user within a single region, and it cannot be transferred to other workspaces or users. The callable functions and model throttling for an API key are inherited from its Workspace permissions; these settings are independent of user console permissions, and you do not need to create different API keys for different models (such as text-to-text, text-to-image, or speech synthesis).

The following actions on the owner's account affect the status of the API key. Both the Alibaba Cloud account and RAM users with API key permission for the workspace can delete API keys.

Action	Alibaba Cloud account	RAM user
Manually delete an API key	Supported (the Alibaba Cloud account has this permission by default; RAM users need the API key management permission for the workspace). The key becomes invalid immediately and cannot be recovered.	Supported (the Alibaba Cloud account has this permission by default; RAM users need the API key management permission for the workspace). The key becomes invalid immediately and cannot be recovered.
Remove the user from the workspace	—	The key becomes invalid. The API key is reactivated if the user is added back to the workspace.
Delete the user or role in theRAM console	—	API keys created before March 25, 2026: deleted with the RAM user and cannot be recovered. API keys created on or after March 25, 2026: not affected and remain valid.
Set an IP whitelist for the API key	Supported for API keys in all regions.	Supported for API keys in all regions.

To manage API keys, choose Account Management in the left-side navigation pane of the Model Studio console, find the target RAM user, and click Permission Management. There you can grant the RAM user permission to create, delete, and view all API keys in the workspace.

In the Edit Permissions dialog box, switch to the Other tab and select API key.

OpenAPI permissions

By default, RAM users cannot call the OpenAPI for application features in Model Studio, including data, knowledge bases, prompt engineering, and long-term memory.

To grant these permissions, the Alibaba Cloud account must assign one of the following policies to the RAM user in the RAM console:

• AliyunBailianDataFullAccess: Allows the user to call all APIs in the Model Studio application API catalog.
• AliyunBailianDataReadOnlyAccess: Allows the user to call read-only APIs in the Model Studio application API catalog, such as DescribeFile - Query file status and GetIndexJobStatus - Query the status of a knowledge base creation job.

Applying to production environments

• Workspace planning strategy

  • Group by environment (Recommended): Create separate workspaces for development, testing, staging, and production environments to ensure strict environment isolation.

    • project-dev-workspace
    • project-test-workspace
    • project-prod-workspace

  • Group by business line: Create separate workspaces for different business units, such as marketing, after-sales, and design, to simplify permission and cost management.

    • marketing-team-workspace
    • customer-team-workspace
• Throttling policy

  • Allocate the total quota of your Alibaba Cloud account proportionally among workspaces and reserve a portion as a buffer to handle unexpected traffic spikes.

    Example: If the total account quota is 1,000 QPM, a possible allocation plan is as follows:

    • project-prod-workspace: 600 QPM (60%)
    • project-test-workspace: 200 QPM (20%)
    • project-dev-workspace: 100 QPM (10%)
    • Reserved buffer: 100 QPM (10%)

Billing and subscription permissions

By default, a RAM user does not have permission to view Alibaba Cloud bills or purchase subscription products. To do so, add specific permissions to the RAM user in the RAM console.

1. To enable a RAM user to view Alibaba Cloud bills, grant them the AliyunBSSReadOnlyAccess permission.
2. To enable a RAM user to purchase Alibaba Cloud subscription products, grant them the AliyunBSSOrderAccess permission.

Fine-grained page permissions

Menu	Submenu	AliyunBSSReadOnlyAccess	AliyunBSSOrderAccess
Account Overview		View page. No operations allowed.	Page not visible. No operations allowed.
Account Overview	Recharge	View page. No operations allowed.	Page not visible. No operations allowed.
Account Overview	Withdrawal	View page. Operations allowed.	Page not visible. No operations allowed.
Account Overview	Refund	View page. No operations allowed.	Page not visible. No operations allowed.
Account Overview	Apply for MYbank loan	View page. Operations allowed.	Page not visible. No operations allowed.
Account Overview	Apply for Alipay down payment tool	View page. Operations allowed.	Page not visible. No operations allowed.
Account Overview	View details	View page. No operations allowed.	Page not visible. No operations allowed.
Account Overview	Voucher management	View page. No operations allowed.	Page not visible. No operations allowed.
Account Overview	Resource plan management	View page. No operations allowed.	Page not visible. No operations allowed.
Account Overview	Request invoice	View page. No operations allowed.	Page not visible. No operations allowed.
Account Overview	Apply for contract	View page. No operations allowed.	Page not visible. No operations allowed.
Transaction Details		View page. No operations allowed.	Page not visible. No operations allowed.
Usage Records	Usage Overview	View page. Operations allowed.	Page not visible. No operations allowed.
Usage Records	Usage Details	View page. Operations allowed.	Page not visible. No operations allowed.
Usage Records	Usage Records	View page. Operations allowed.	Page not visible. No operations allowed.
Usage Records	Instance Usage Details	View page. Operations allowed.	Page not visible. No operations allowed.
Usage Records	Monthly Cost Consumption	View page. Operations allowed.	Page not visible. No operations allowed.
Usage Records	Export Records	View page. Operations allowed.	Page not visible. No operations allowed.
Usage Records	Store to OSS	View page. Operations allowed.	Page not visible. No operations allowed.
Bill Analysis	Product Bill Analysis	View page. Operations allowed.	Page not visible. No operations allowed.
Deposit Management		View page. No operations allowed.	Page not visible. No operations allowed.
Order Management		View page. No operations allowed.	View page. Operations allowed.
Voucher Management		View page. No operations allowed.	Page not visible. No operations allowed.
Coupon Management		Page not visible. No operations allowed.	Page not visible. No operations allowed.
Stored-value Card Management		Page not visible. No operations allowed.	Page not visible. No operations allowed.
Redemption Voucher Management		Page not visible. No operations allowed.	Page not visible. No operations allowed.
Purchase Order		Page not visible. No operations allowed.	Page not visible. No operations allowed.
Resource Plan Management	Resource Plan Overview	View page. No operations allowed.	Page not visible. No operations allowed.
Resource Plan Management	Usage Details	View page. No operations allowed.	Page not visible. No operations allowed.
Invoice Management	Request Invoice	View page. No operations allowed.	Page not visible. No operations allowed.
Invoice Management	Invoice List	View page. No operations allowed.	Page not visible. No operations allowed.
Invoice Management	Invoice Information Management	View page. No operations allowed.	Page not visible. No operations allowed.
Invoice Management	Invoice Shipping Address Management	View page. No operations allowed.	Page not visible. No operations allowed.
Remittance Slip Management		View page. No operations allowed.	Page not visible. No operations allowed.
Subscription Management	No-questions-asked refund within five days	View page. No operations allowed.	Page not visible. No operations allowed.
Subscription Management	Unsubscription Record	View page. No operations allowed.	Page not visible. No operations allowed.
Contract Management	Contract Application	View page. No operations allowed.	Page not visible. No operations allowed.
Contract Management	Contract Management	View page. No operations allowed.	Page not visible. No operations allowed.
Availability Center		Page not visible. No operations allowed.	Page not visible. No operations allowed.
Renewal Management		Page not visible. No operations allowed.	Page not visible. No operations allowed.
Purchase Page	Product Purchase Pages	View page. No operations allowed.	View page. No operations allowed.

Common settings

Configure a super administrator

Only an Alibaba Cloud account (primary account) or a RAM user with the AliyunRAMFullAccess system policy can perform this operation.

1. Go to the RAM console and grant the RAM user the AliyunBailianFullAccess (Model Studio administrator) and AliyunBSSOrderAccess (for purchasing Alibaba Cloud subscription products) permissions.
2. After granting these permissions, you can use the Model Studio global management menu (China (Beijing) | Singapore | US (Virginia) | Germany (Frankfurt) | China (Hong Kong)) to manage permissions for any RAM user (including yourself) across all regions and workspaces, and to purchase Model Studio subscription products.

Configure a workspace administrator

This operation requires a super administrator or a workspace administrator.

1. In the left-side navigation pane of the Model Studio console, choose Account Management, find the target RAM user, click Permission Management, and grant the Administrator permission.

   In the Edit Permissions dialog box, switch to the Other tab, and then select Administrator.

Configure model calling permissions

1. If you do not use the default workspace, ensure that the model calling permission is enabled for the specific model in the workspace. (This operation requires a super administrator.)

2. To call models from the Model Studio console, choose Account Management in the left-side navigation pane of the Model Studio console, find the target RAM user, click Permission Management, and grant the following permissions: (This operation requires a super administrator or a workspace administrator.)

   1. Playground-FullAccess to call models from the console.
   2. BatchInference-FullAccess to use the batch inference feature.
   3. ModelObservation-FullAccess to view the token consumption of model calls and evaluations.

3. To call models using the Model Studio API, create or assign an API key for the RAM user in the corresponding workspace. For more information, see API key permissions. (This operation requires a super administrator or a workspace administrator.)

Console permissions for model fine-tuning

1. If you do not use the default workspace, ensure that the model fine-tuning (training) permission is enabled for the specific model in the workspace. (This operation requires a super administrator.)

2. In the left-side navigation pane of the Model Studio console, choose Account Management, find the target RAM user, click Permission Management, and grant the following model permissions: (This operation requires a super administrator or a workspace administrator.)

   1. Playground-FullAccess to call fine-tuned models from the console.
   2. ModelFine-tuning-FullAccess permission.
   3. MyModels-FullAccess to manage model snapshots after fine-tuning is complete.
   4. ModelDeployment-FullAccess to deploy fine-tuned models. You can call and evaluate a model only after deploying it.
   5. ModelEvaluation-FullAccess permission.
   6. DataManagement-FullAccess to manage fine-tuning datasets.
   7. ModelObservation-FullAccess to view the token consumption of model calls and evaluations.

API permissions for model fine-tuning

1. If you do not use the default workspace, ensure that the model fine-tuning (training) permission is enabled for the specific model in the workspace. (This operation requires a super administrator.)
2. Create or assign an API key for the RAM user in the corresponding workspace. For more information, see API key permissions. (This operation requires a super administrator or a workspace administrator.)

FAQ

1. Getting the workspace ID

For details, see Get a workspace ID in application development.

2. Call a model from a sub-workspace

You can use the sub-workspace API key without any special configuration.

3. Use applications in a workspace

To call an application in a workspace via the API, you need the corresponding APP ID and Workspace ID.

4. What should I do if a RAM user has AliyunBailianFullAccess but still cannot manage workspaces?

RAM permissions (such as AliyunBailianFullAccess) and workspace-level permissions in Model Studio are two independent permission systems. RAM permissions only control access to the Model Studio console, whereas workspace management permissions (such as editing a workspace or managing members) must be separately granted by the Alibaba Cloud account or a super administrator in the Model Studio console.

If a RAM user already has the AliyunBailianFullAccess permission but still receives a permission-denied message when managing a workspace, perform the following steps:

1. Log on to the Model Studio console with the Alibaba Cloud account.
2. Click the settings icon in the upper-right corner and choose Account Management in the left-side navigation pane.
3. Find the RAM user to authorize and click Permission Management.
4. Grant the RAM user the management permission for the corresponding workspace.

5. How do I delete a workspace?

Go to the Model Studio console, select the target region in the upper-right corner of the page, go to the Workspace Management page, and select Delete in the Actions column; or call the DeleteWorkspace API (DELETE /modelstudio/workspaces/{workspaceId}). Deleted workspaces cannot be recovered.

Prerequisites for deletion: Only workspaces that meet the following conditions can be deleted:

1. The workspace is not the default workspace.
2. The workspace has not been used to purchase other products, such as Miaobi.
3. In permission management, the workspace has not been granted to any RAM user or RAM role.
4. The workspace no longer contains any resources, such as API keys, model deployments, or knowledge bases.

Clean up dependencies: Before deletion, you must first clean up the resources of each sub-product under the workspace:

Sub-product	Items to clean up
CCAI Dialogue Analysis AIO	Delete all applications in the workspace and confirm that no data or API keys remain
Multimodal Interaction Suite	Delete all applications
Tingwu	Search for "Tingwu" in the workbench and delete the corresponding workspace
RAG Knowledge Base	Delete all services under Knowledge Management, Knowledge Retrieval, and Knowledge Q&A
Data Connection / RAG Dataset / Connector	Delete all connectors, uploaded files, tables, and Connector connections
Model Training && Inference	Delete all datasets, training tasks, my models, and deployments
Observability resources	Disable model monitoring, audit logs, inference log data delivery, and application observability
Evaluation resources	Terminate or delete unfinished model evaluation and application evaluation tasks

If deletion fails and failReasons is returned, clean up the corresponding resources as prompted and try again.

6. How do I implement fine-grained permission control over the knowledge base and long-term memory?

You can create a custom policy in the RAM console that grants only the permissions needed for the required operations.

Knowledge base actions: sfm:CreateIndex, sfm:UpdateIndex, sfm:DeleteIndex, and sfm:SubmitIndexJob. Long-term memory actions: sfm:CreateMemory, sfm:UpdateMemory, and sfm:DeleteMemory.

Example custom policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sfm:CreateIndex",
        "sfm:UpdateIndex",
        "sfm:DeleteIndex",
        "sfm:SubmitIndexJob",
        "sfm:CreateMemory",
        "sfm:UpdateMemory",
        "sfm:DeleteMemory"
      ],
      "Resource": "*"
    }
  ]
}

After you create the custom policy, attach it to the RAM sub-user to grant the minimum CRUD permissions for the knowledge base and long-term memory. For the complete list of actions, see "Authorization information".