osFoundry / Platform
RBAC & permissions
Granular roles per workspace and per resource. Custom roles supported.
What it is
RBAC & permissions in osFoundry is role-based access control scoped to the level that actually matters: per workspace and per individual resource. A workspace groups your chats, agents, apps, code, knowledge and data; RBAC decides who inside that workspace can see and act on each of those things. Instead of one blunt "member or admin" switch, you grant roles that map to how your team really works, and you can narrow access down to a single resource rather than the whole workspace.
Because osFoundry is a bring-your-own-key, local-first desktop workspace, permissions govern access to shared resources without requiring your data or model traffic to leave your control. You bring your own API keys, so access to a model or an agent is a question of workspace roles, not of a reseller doling out seats. When the built-in roles don't fit, custom roles let you define exactly what a role can do — useful when a contractor should read a knowledge base but not edit agents, or a teammate should run an app without touching its code.
This matters because AI workspaces accumulate sensitive material fast: prompts, connected data sources, agent configurations, and code. Coarse permissions force a choice between locking people out and over-sharing. Granular per-resource roles plus custom roles let you give each person exactly the access their work needs and nothing more, which keeps collaboration open while keeping the blast radius of any single account small.
Key capabilities
- Assign roles per workspace to control baseline access for every member
- Scope permissions to individual resources — a specific chat, agent, app, or data source
- Define custom roles when the built-in roles don't match your team's structure
- Govern access to chat, agents, apps, code, knowledge and data from one place
- Control resource access by role rather than paying per seat, since osFoundry has no per-seat fees
Use cases
- Team lead: grant a contractor read access to one knowledge base while blocking agent and code edits
- Security-conscious admin: build a custom role that can run apps but cannot view or modify their source code
- Workspace owner: separate day-to-day members from admins so only trusted roles change agent configurations
Frequently asked questions
Can I set permissions on a single resource, or only for the whole workspace?
Both. osFoundry supports roles at the workspace level for baseline access and at the individual resource level, so you can grant someone access to one specific chat, agent, app, or data source without opening up the rest of the workspace.
What if the built-in roles don't fit my team?
You can create custom roles. Define a role that matches your team's structure — for example, someone who can read knowledge but not edit agents — instead of forcing everyone into a predefined admin-or-member split.
Does RBAC affect billing or add a per-seat charge?
No. osFoundry has no per-seat fees, and it's bring-your-own-key, so roles control who can access which resources rather than gating access behind paid seats. Assigning a role doesn't add a subscription cost per person.