Access control

The hub provides to kinds of access control.

Role-based access control is used to determine what level of administrative control a particular user has within a given organisation.

Team-based access control specifies, to a very fine level of granularity, which users can have access to which generator models based on both the generator itself and also the level of privacy afforded by the generator models.

Role-based access control

The Hub has two levels of access control. Hub-level roles are applied to users and allow for high-level configuration of the Hub instance, including creating users, organisations and managing Synthesiser images. For more information see the Hub administration guide.

Alternatively there are organisation-level roles, which determine which actions within an organisation a user can perform. These roles are described below.

Each user within an organisation is given a particular role within it. These determine their level of control over that organisation.

The levels available are, in order of most control to least, are:

Owner. Able to perform any action within the organisation, including creating new Generators and editing the organisation’s settings.

Admin. Able to perform any action within the organisation, except create or delete Generators or edit the organisation itself.

Member. Has read-only access to every aspect of the organisation.

Generator Administrator. Has edit permissions over all aspects of the organisation's generators, but no control of other areas, such as access control.

Team Member. Has read-only permissions to view the subset of generators specified by the user’s Team memberships (see below).

"Owner" and "Admin" level users will be able to create new users and assign them to any role within the organisation less than or equal to their own, i.e. Owners can create new Owners, Admins, etc. Admins can create new Admins, Members, etc, but Admins cannot create new Owners.

Any user given a Role greater than Team Member within an organisation will be able to view all generators within that Organisation, irrespective of any team memberships, both within the hub’s administrative web interface and via the API.

Team-based access control

Team-based access control only applies to users with the "Team Member" role within an organisation.

A user assigned the "Team Member" role will not be given any administrative control over the hub itself, and the set of generators available for them to view will be solely determined by their Team memberships, both in the hub UI and in the API.

Each team has permissions to view the models belonging to a specified set of generators. For each generator a team is granted permission to access generator models, optionally restricted to a set of conditions to further limit access, for example to some minimum privacy level determined by the Models' epsilon value.

When determining the privacy level granted to a team, an administrator has two options:

  1. Grant unlimited access to models for this generator

  2. Grant access only to models that match the conditions set in the restrictions.

This access restriction will be applied both when querying via the API or viewing generator models (and their associated metrics) within the Hub.

A team member that logs into the Hub administrative UI will be presented with a read-only view of the generators that are assigned to their Team memberships.

A user can belong to many teams within an organisation. If a team member is given access to the same generator by two different teams, then they will be able to access models set by either team’s restrictions.