exa-enterprise-rbac

# Exa Enterprise RBAC ## Overview Manage access to Exa search API through API key scoping and application-level controls. Exa is API-key-based (no built-in RBAC), so access control is implemented through multiple API keys per use case, application-layer permission enforcement, domain restrictions per team, and per-key usage monitoring. ## Prerequisites - Exa API account with team/enterprise plan - Dashboard access at dashboard.exa.ai - Multiple API keys for key isolation ## Instructions ### Step 1: Key-Per-Use-Case Architecture ```typescript // config/exa-keys.ts import Exa from "exa-js"; // Create separate clients for each use case const exaClients = { // High-volume RAG pipeline — production key with higher limits ragPipeline: new Exa(process.env.EXA_KEY_RAG!), // Internal research tool — lower volume key researchTool: new Exa(process.env.EXA_KEY_RESEARCH!), // Customer-facing search — separate key for isolation customerSearch: new Exa(process.env.EXA_KEY_CUSTOMER!), }; export function getExaForUseCase( useCase: keyof typeof exaClients ): Exa { const client = exaClients[useCase]; if (!client) throw new Error(`No Exa client for use case: ${useCase}`); return client; } ``` ### Step 2: Application-Level Permission Enforcement ```typescript // middleware/exa-permissions.ts interface ExaPermissions { maxResults: number; allowedTypes: ("auto" | "neural" | "keyword" | "fast" | "deep")[]; allowedCategories: string[]; includeDomains?: string[]; ...