Auth Workspaces Rbac Governance

Operator generates a LANGSMITH_API_KEY from Settings → API Keys for a CI pipeline. CI must only see one workspace's data.

Create the key inside the intended workspace; the key is scoped to that workspace by construction and cannot read another workspace's projects or datasets. Store as a CI secret. Rotate on a schedule and on personnel change. Audit via Settings → API Keys → last-used.

Engineering can write traces, finance can only read cost dashboards, and external auditors get read-only access to one project.

Use workspace roles: developer (read/write) for engineering, viewer (read) for finance, and an auditor role scoped to a single project for external auditors. Confirm RBAC scope via Settings → Members. Avoid granting Admin broadly.

Customer A and Customer B are different workspaces in the operator's org. A user with access only to A's workspace must not see B's projects.

Use distinct workspaces per customer (or use ABAC roles per project if the Enterprise plan supports it). Verify isolation by attempting to list B's projects with an A-scoped key — expect 403 / empty list. Document the isolation model in the SOC 2 narrative.