Roles, audit log, and model governance

The permission taxonomy behind workspace roles, what the audit log records, and how the model request/approve flow works.

Relixr's access control is built from a fixed, server-owned permission taxonomy — not a free-text role name. That's what makes it possible to say precisely what a role, or a key, is allowed to do.

The permission taxonomy

Permissions are split into read and manage pairs across each area of the workspace: members, keys, agents, billing, invoices, budgets, models, and policies — plus two standalone permissions, audit:read and security:read, for people who need visibility without management rights. A role is just a named set of these permissions.

What the audit log captures

Every workspace-level mutation — a role change, a policy update, a key created or revoked — is written to the workspace activity log with the actor, the action, the target, and a timestamp. It's separate from Relixr's own internal platform logs; this is the customer-facing record, meant to be read by your own team. Anyone holding audit:read can pull it up from Team → Audit log without needing broader management access.

Requesting and approving models

Instead of every model a provider ships being immediately callable by anyone in the workspace, model access can run through a request/approve flow: a member requests a model, and someone holding model-approval permission decides whether it's added to the workspace's allowed set. Combine this with a model allowlist guardrail so "which models can this workspace call" reflects a decision your team made, not just what happened to exist upstream.

Putting it together

1. Define roles around the permission taxonomy before inviting a broad set of members — see Relixr for enterprise teams.
2. Grant audit:read to anyone in security or compliance who needs visibility without needing keys:manage or billing:manage.
3. Turn on the model request/approve flow once more than a couple of people can request model access, so growth in the catalog doesn't silently become growth in what's callable.