clade-enterprise-rbac

# Anthropic Enterprise & Access Management ## Overview Anthropic uses **Organizations** and **Workspaces** for access control. API keys are scoped to workspaces. ## Organization Structure ``` Organization (your-company) ├── Workspace: Production │ ├── API Key: prod-backend (Tier 4) │ └── API Key: prod-frontend-proxy (Tier 2) ├── Workspace: Staging │ └── API Key: staging-all (Tier 2) └── Workspace: Development └── API Key: dev-team (Tier 1) ``` ## API Key Best Practices | Practice | Why | |----------|-----| | One key per service/environment | Isolate blast radius | | Name keys descriptively | `prod-recommendation-service` not `key-1` | | Set spending limits per key | Prevent runaway costs from bugs | | Rotate quarterly | Reduce exposure window | | Never share dev and prod keys | Different rate limit tiers | ## Spending Limits Set in Anthropic Console → Settings → Limits: - **Monthly spend limit**: Hard cap on total spend - **Per-key limits**: Not yet available — use separate workspaces ## Access Control Checklist - [ ] Separate workspaces for dev/staging/prod - [ ] Separate API keys per service - [ ] Spending alerts configured - [ ] Key rotation schedule (90 days) - [ ] Offboarding process: revoke keys when team members leave - [ ] Audit log review (Console → Logs) ## Output - Separate workspaces for production, staging, and development - Dedicated API keys per service/environment with descriptive names - Spending limits and alerts configured - Key rotation sch...