langfuse-enterprise-rbac

# Langfuse Enterprise RBAC ## Overview Configure enterprise access control for Langfuse: built-in roles and permissions, scoped API keys per service, SSO integration, project-level isolation, and audit logging for compliance. ## Prerequisites - Langfuse Cloud (Team/Enterprise plan) or self-hosted instance - Organization admin access - SSO provider (optional, for SAML/OIDC integration) ## Langfuse Built-In Roles Langfuse provides these roles at the project level: | Role | View Traces | Create Traces | Manage Prompts | Manage Members | Manage Billing | |------|------------|---------------|----------------|----------------|---------------| | **Owner** | Yes | Yes | Yes | Yes | Yes | | **Admin** | Yes | Yes | Yes | Yes | No | | **Member** | Yes | Yes | Yes | No | No | | **Viewer** | Yes | No | No | No | No | ## Instructions ### Step 1: Organization and Project Structure ``` Organization: Acme Corp ├── Project: production-chatbot │ ├── Owner: engineering-lead@acme.com │ ├── Admin: senior-dev@acme.com │ ├── Member: developer@acme.com │ └── API Key: sk-lf-prod-chatbot-... │ ├── Project: staging-chatbot │ ├── Admin: senior-dev@acme.com │ ├── Member: developer@acme.com │ └── API Key: sk-lf-staging-chatbot-... │ └── Project: analytics-readonly ├── Admin: data-lead@acme.com ├── Viewer: analyst@acme.com └── API Key: sk-lf-analytics-... ``` **Best practice:** Separate projects for production, staging, and analytics. Never share API keys across environmen...