mistral-enterprise-rbac

name	mistral-enterprise-rbac
description	Configure Mistral AI enterprise access control and workspace management. Use when implementing role-based API key scoping, managing team access, or setting up organization-level controls for Mistral AI. Trigger with phrases like "mistral access control", "mistral RBAC", "mistral enterprise", "mistral roles", "mistral team".
allowed-tools	Read, Write, Edit
version	1.12.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","mistral","rbac"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Mistral AI Enterprise RBAC

Overview

Control access to Mistral AI at the organization level using La Plateforme workspace management: scoped API keys per team, model access restrictions, spending limits, key auditing, and automated rotation. Mistral organizes access via Organizations > Workspaces > API Keys, with rate limits set at the workspace level.

Prerequisites

• Mistral La Plateforme organization account (console.mistral.ai)
• Organization admin or owner role
• Understanding of workspace vs key-level controls

Instructions

Step 1: Workspace Strategy

Workspace	Team	Models Allowed	RPM	Monthly Budget
dev-workspace	All developers	mistral-small, codestral	60	$50
ml-workspace	ML engineers	All models	200	$500
prod-workspace	CI/CD only	Per-service scoped	500	$2000

Create workspaces via La Plateforme console: Organization > Workspaces > Create.

Step 2: Scoped API Keys per Team

Create keys with model restrictions and rate limits in the console, or via API:

set -euo pipefail
# Dev team — restricted to cost-effective models
curl -X POST https://api.mistral.ai/v1/api-keys \
  -H "Authorization: Bearer $MISTRAL_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "dev-team-key",
    "description": "Dev team — small models only",
    "workspace_id": "ws_dev_xxx"
  }'

# ML team — full model access
curl -X POST https://api.mistral.ai/v1/api-keys \
  -H "Authorization: Bearer $MISTRAL_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ml-team-key",
    "description": "ML team — all models",
    "workspace_id": "ws_ml_xxx"
  }'

Step 3: Application-Level Model Gateway

Enforce model access in your application layer:

 : <, {
  : [];
  : ;
  : ;
}> = {
  : {
    : [, ],
    : ,
    : ,
  },
  : {
    : [, , ],
    : ,
    : ,
  },
  : {
    : [, , , ],
    : ,
    : ,
  },
  : {
    : [],
    : ,
    : ,
  },
};

 ():  {
   perms = [role];
   (!perms)  ;

   modelAllowed = perms..() || perms..(model);
   tokensAllowed = estimatedTokens <= perms.;

   modelAllowed && tokensAllowed;
}