ideogram-enterprise-rbac

# Ideogram Enterprise RBAC ## Overview Implement team-based access control for Ideogram's API. Since Ideogram uses a single API key per account with no built-in roles or scopes, enterprise access control must be implemented at the application layer: separate API keys per team, proxy-based content filtering, per-team budget limits, and usage tracking. ## Architecture ``` ┌──────────────────────────────────────────┐ │ Application Proxy Layer │ │ ┌──────────┐ ┌──────────┐ ┌────────┐ │ │ │ Marketing│ │ Product │ │ Social │ │ │ │ API Key │ │ API Key │ │API Key │ │ │ └────┬─────┘ └────┬─────┘ └───┬────┘ │ │ └──────────────┼────────────┘ │ │ ▼ │ │ ┌────────────────────────────────────┐ │ │ │ Content Filter + Budget Enforcer │ │ │ └──────────────────┬─────────────────┘ │ └─────────────────────┼────────────────────┘ ▼ Ideogram API (api.ideogram.ai) ``` ## Instructions ### Step 1: Team Configuration ```typescript interface TeamConfig { name: string; apiKey: string; // Separate Ideogram API key per team dailyBudgetUSD: number; allowedStyles: string[]; allowedModels: string[]; maxConcurrency: number; contentPolicy: "strict" | "moderate" | "permissive"; } const TEAM_CONFIGS: Record<string, TeamConfig> = { marketing: { name: "Marketing", apiKey: process.env.IDEOGRAM_KEY_MARKETING!, dailyBudgetUSD: 20, allowedStyles: ["D...