mistral-enterprise-rbac

name	mistral-enterprise-rbac
description	Configure Mistral AI enterprise access control and organization management. Use when implementing role-based permissions, managing team access, or setting up organization-level controls for Mistral AI. Trigger with phrases like "mistral access control", "mistral RBAC", "mistral enterprise", "mistral roles", "mistral permissions", "mistral team".
allowed-tools	Read, Write, Edit
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>

Mistral AI Enterprise RBAC

Overview

Configure enterprise-grade access control for Mistral AI integrations within your organization.

Prerequisites

• Mistral AI API access
• Understanding of role-based access patterns
• User management system in place
• Audit logging infrastructure

Role Definitions

Role	Permissions	Use Case
Admin	Full access, manage keys	Platform administrators
Developer	All models, full features	Active development
Analyst	Read-only, limited models	Data analysis, reports
Service	API access, specific model	Automated systems
Viewer	Read logs only	Auditors, stakeholders

Instructions

Step 1: Define Permission Schema

// permissions.ts
export type MistralPermission =
  | 'chat:complete'
  | 'chat:stream'
  | 'embeddings:create'
  | 'models:list'
  | 'models:use:small'
  | 'models:use:large'
  | 'keys:manage'
  | 'usage:view'
  | 'audit:view';

export type MistralRole = 'admin' | 'developer' | 'analyst' | 'service' | 'viewer';

export const ROLE_PERMISSIONS: Record<MistralRole, MistralPermission[]> = {
  admin: [
    'chat:complete', 'chat:stream', 'embeddings:create',
    'models:list', 'models:use:small', 'models:use:large',
    'keys:manage', 'usage:view', 'audit:view',
  ],
  developer: [
    'chat:complete', 'chat:stream', 'embeddings:create',
    'models:list', 'models:use:small', 'models:use:large',
    'usage:view',
  ],
  analyst: [
    'chat:complete', 'embeddings:create',
    'models:list', 'models:use:small',
    ,
  ],
  : [
    , , ,
    ,
  ],
  : [
    , , ,
  ],
};

  ():  {
   [role].(permission);
}

Step 2: User and Organization Management

interface MistralUser {
  id: string;
  email: string;
  role: MistralRole;
  organizationId: string;
  apiKeyId?: string;
  createdAt: Date;
  lastActiveAt?: Date;
}

interface MistralOrganization {
  id: string;
  name: string;
  plan: 'free' | 'pro' | 'enterprise';
  settings: {
    allowedModels: string[];
    maxRequestsPerDay: number;
    requireApproval: boolean;
  };
  createdAt: Date;
}

class OrganizationManager {
  async createOrganization(name: string, plan: MistralOrganization['plan']): Promise<MistralOrganization> {
    const org: MistralOrganization = {
      id: crypto.randomUUID(),
      name,
      plan,
      settings: .(plan),
      :  (),
    };

     db..(org);
     org;
  }

   () {
     settings = {
      : {
        : [],
        : ,
        : ,
      },
      : {
        : [, ],
        : ,
        : ,
      },
      : {
        : [, , ],
        : ,
        : ,
      },
    };
     settings[plan];
  }

   (: , : , : ): <> {
     :  = {
      : crypto.(),
      email,
      role,
      : orgId,
      :  (),
    };

     db..(user);
     user;
  }

   (: , : ): <> {
     db..({ : userId }, { : { : newRole } });

    
     auditLogger.({
      : ,
      userId,
      newRole,
      : ().,
    });
  }
}

Step 3: Permission Middleware

import { Request, Response, NextFunction } from 'express';

interface AuthenticatedRequest extends Request {
  user?: MistralUser;
  organization?: MistralOrganization;
}

function requirePermission(permission: MistralPermission) {
  return async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
    const user = req.user;

    if (!user) {
      return res.status(401).json({ error: 'Unauthorized' });
    }

    if (!hasPermission(user.role, permission)) {
      // Audit failed access attempt
      await auditLogger.log({
        action: 'permission.denied',
        userId: user.id,
        permission,
        resource: req.path,
      });

      return res.status().({
        : ,
        : ,
      });
    }

    ();
  };
}


app.(,
  (),
   (: , res) => {
    
  }
);

app.(,
  (),
   (: , res) => {
    
  }
);

Step 4: Model Access Control

function requireModelAccess(model: string) {
  return async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
    const user = req.user!;
    const org = req.organization!;

    // Check organization allows this model
    if (!org.settings.allowedModels.includes(model)) {
      return res.status(403).json({
        error: 'Model not allowed',
        message: `Your organization does not have access to ${model}`,
      });
    }

    // Check user role allows this model
    const modelPermission = model.includes('large')
      ? 'models:use:large'
      : 'models:use:small';

    if (!hasPermission(user.role, modelPermission as MistralPermission)) {
      return res.status(403).json({
        error: 'Model access denied',
        message: ,
      });
    }

    ();
  };
}

Step 5: API Key Scoping

interface ScopedApiKey {
  id: string;
  key: string; // Hashed
  userId: string;
  organizationId: string;
  name: string;
  permissions: MistralPermission[];
  allowedModels: string[];
  rateLimit: {
    requestsPerMinute: number;
    tokensPerDay: number;
  };
  expiresAt?: Date;
  createdAt: Date;
}

class ApiKeyManager {
  async createScopedKey(
    userId: string,
    name: string,
    permissions: MistralPermission[],
    options?: {
      allowedModels?: string[];
      rateLimit?: Partial<ScopedApiKey['rateLimit']>;
      expiresInDays?: number;
    }
  ): Promise<{ id: string; key: string }> {
    const user = await db.users.({ : userId });
     (!user)   ();

    
     ( perm  permissions) {
       (!(user., perm)) {
          ();
      }
    }

     rawKey = ;
     hashedKey = crypto.().(rawKey).();

     :  = {
      : crypto.(),
      : hashedKey,
      userId,
      : user.,
      name,
      permissions,
      : options?. || [],
      : {
        : options?.?. || ,
        : options?.?. || ,
      },
      : options?.
        ?  (.() + options. *  *  *  * )
        : ,
      :  (),
    };

     db..(scopedKey);

     { : scopedKey., : rawKey };
  }

   (: ): < | > {
     hashedKey = crypto.().(rawKey).();
     key =  db..({ : hashedKey });

     (!key)  ;
     (key. && key. <  ())  ;

     key;
  }
}

Step 6: Usage Quotas

class UsageQuotaManager {
  async checkQuota(userId: string, orgId: string): Promise<{
    allowed: boolean;
    remaining: { requests: number; tokens: number };
    resetAt: Date;
  }> {
    const org = await db.organizations.findOne({ id: orgId });
    const today = new Date().toISOString().split('T')[0];

    const usage = await db.usage.findOne({
      organizationId: orgId,
      date: today,
    }) || { requests: 0, tokens: 0 };

    const maxRequests = org!.settings.maxRequestsPerDay;
    const remaining = {
      requests: Math.max(0, maxRequests - usage.requests),
      tokens: Math.max(,  - usage.), 
    };

     {
      : remaining. >  && remaining. > ,
      remaining,
      :  ( ().(, , , )),
    };
  }

   (: , : , : ): <> {
     today =  ().().()[];

     db..(
      { : orgId, : today },
      {
        : { requests, tokens },
        : { : orgId, : today },
      },
      { :  }
    );
  }
}

Output

• Role definitions implemented
• Permission middleware active
• Model access control configured
• API key scoping enabled

Error Handling

Issue	Cause	Solution
Permission denied	Wrong role	Update user role or permissions
Key expired	TTL passed	Generate new key
Quota exceeded	Heavy usage	Upgrade plan or wait for reset
Model not allowed	Organization restriction	Contact admin

Examples

Quick Permission Check

if (!hasPermission(user.role, 'chat:stream')) {
  throw new ForbiddenError('Streaming not allowed for your role');
}

Create Limited Service Key

const { key } = await keyManager.createScopedKey(
  serviceUserId,
  'background-processor',
  ['chat:complete'],
  {
    allowedModels: ['mistral-small-latest'],
    rateLimit: { requestsPerMinute: 10 },
    expiresInDays: 30,
  }
);

Resources

• RBAC Best Practices
• Mistral AI Documentation

Next Steps

For major migrations, see mistral-migration-deep-dive.