| name | langfuse-enterprise-rbac |
| description | Configure Langfuse enterprise organization management and access control.
Use when implementing team access controls, configuring organization settings,
or setting up role-based permissions for Langfuse projects.
Trigger with phrases like "langfuse RBAC", "langfuse teams",
"langfuse organization", "langfuse access control", "langfuse permissions".
|
| allowed-tools | Read, Write, Edit |
| version | 1.12.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","langfuse","rbac"] |
| compatibility | Designed for Claude Code, also compatible with Codex and OpenClaw |
Langfuse Enterprise RBAC
Overview
Configure enterprise access control for Langfuse: built-in roles and permissions, scoped API keys per service, SSO integration, project-level isolation, and audit logging for compliance.
Prerequisites
- Langfuse Cloud (Team/Enterprise plan) or self-hosted instance
- Organization admin access
- SSO provider (optional, for SAML/OIDC integration)
Langfuse Built-In Roles
Langfuse provides these roles at the project level:
| Role | View Traces | Create Traces | Manage Prompts | Manage Members | Manage Billing |
|---|
| Owner | Yes | Yes | Yes | Yes | Yes |
| Admin | Yes | Yes | Yes | Yes | No |
| Member | Yes | Yes | Yes | No | No |
| Viewer | Yes | No | No | No | No |
Instructions
Step 1: Organization and Project Structure
Organization: Acme Corp
โโโ Project: production-chatbot
โ โโโ Owner: engineering-lead@acme.com
โ โโโ Admin: senior-dev@acme.com
โ โโโ Member: developer@acme.com
โ โโโ API Key: sk-lf-prod-chatbot-...
โ
โโโ Project: staging-chatbot
โ โโโ Admin: senior-dev@acme.com
โ โโโ Member: developer@acme.com
โ โโโ API Key: sk-lf-staging-chatbot-...
โ
โโโ Project: analytics-readonly
โโโ Admin: data-lead@acme.com
โโโ Viewer: analyst@acme.com
โโโ API Key: sk-lf-analytics-...
Best practice: Separate projects for production, staging, and analytics. Never share API keys across environments.
Step 2: Scoped API Keys
Create API keys with specific purposes and rotate regularly:
() {
pk = process.. || ;
(!pk.(expectedProject)) {
.(
);
}
}
() {
.();
.();
.();
.();
.();
.();
}