AI Management roles control who can create and manage models, MCP servers, agents, and virtual keys, and who can view cost data. Org Admins set up models, MCP servers, and agents. Team Managers and Individual Users ask an Org Admin for access.
AI Management roles and permissions
Uses:
AI Gateway
Related Documentation
Incompatible with
on-prem
Tags
Related Resources
Roles
|
Role |
Who has it |
What the role does |
|---|---|---|
| Org Admin | A member of the Konnect Organization Admin or Identity Admin team. | Creates and manages resources, users, and access for the whole organization. |
| Team Manager | The owner of a Team in the org chart. | Sees spend and budgets for their teams, and requests resources and access. |
| Individual User | Any other user in the organization. | Requests resources and access. |
Models
|
Capability |
Org Admin |
Team Manager |
Individual User |
|---|---|---|---|
| Add a model with New > Model | Supported | Not supported | Not supported |
| Ask an Org Admin to add a model with Request a model | Not supported | Supported | Supported |
| Turn a model on or off | Supported | Not supported | Not supported |
| Edit or delete a model from the Actions menu | Supported | Not supported | Not supported |
| View a model’s auth strategies, ACLs, and policies in the Edit form | Supported | Not supported | Not supported |
| Request access to call a model with Request access | Not supported | Supported | Supported |
| Manage virtual keys from a model | Supported | Supported | Supported |
Providers
Providers are under Models > Providers in the sidebar.
|
Capability |
Org Admin |
Team Manager |
Individual User |
|---|---|---|---|
| Add a provider with New provider | Supported | Not supported | Not supported |
| Edit or delete a provider from the Actions menu | Supported | Not supported | Not supported |
| View a provider’s authentication type and details | Supported | Supported | Supported |
MCP servers
|
Capability |
Org Admin |
Team Manager |
Individual User |
|---|---|---|---|
| Add an MCP server with New > MCP server | Supported | Not supported | Not supported |
| Ask an Org Admin to add an MCP server with Request an MCP server | Not supported | Supported | Supported |
| Turn an MCP server on or off | Supported | Not supported | Not supported |
| Edit or delete an MCP server from the Actions menu | Yes. Passthrough servers have only Delete. | Not supported | Not supported |
| View an MCP server’s tools | Supported | Supported | Supported |
| Change logging for an MCP server with Log payloads and Log audits | Supported | Not supported | Not supported |
| Set an MCP server to get its upstream credential from Token Vault with Outbound authentication > Use a credential provider | Supported | Not supported | Not supported |
| View an MCP server’s outbound authentication | Supported | Not supported | Not supported |
| Request access to call an MCP server with Request access | Not supported | Supported | Supported |
| Manage virtual keys from an MCP server | Supported | Supported | Supported |
Agents
|
Capability |
Org Admin |
Team Manager |
Individual User |
|---|---|---|---|
| Add an agent with New agent | Supported | Not supported | Not supported |
| Ask an Org Admin to add an agent with Request an agent | Not supported | Supported | Supported |
| Turn an agent on or off | Supported | Not supported | Not supported |
| Edit, delete, debug, or link an identity record to an agent from the Actions menu | Supported | Not supported | Not supported |
| Change logging for an agent with Log payloads | Supported | Not supported | Not supported |
| Request access to call an agent with Request access | Not supported | Supported | Supported |
| Manage virtual keys from an agent | Supported | Supported | Supported |
Access Management
Access Management has pages for users, groups, and virtual keys. Users and agents are Kong Identity principals.
|
Capability |
Org Admin |
Team Manager |
Individual User |
|---|---|---|---|
| Open the Users, Identity Providers, and Token Vault pages | Supported | Not supported | Not supported |
| View groups | All groups | Only their groups | Only their groups |
| View virtual keys | All keys | Their own keys, and keys in the groups that they manage | Only their own keys |
| Create a virtual key with New key | Supported | Supported | Supported |
| Delete a virtual key | Supported | Yes, for keys they can view | Yes, for their own keys |
Cost Management
|
Capability |
Org Admin |
Team Manager |
Individual User |
|---|---|---|---|
| View their own spend in My Usage | Supported | Supported | Supported |
| View the cost dashboard and explorer | Yes, for the whole organization | Yes, for their teams | Not supported |
| View and create budgets | Yes, for the whole organization | Yes, for their teams | Not supported |
| Use the price catalog, attribution, and exports | Supported | Not supported | Not supported |
Observability
Individual Users can view a dashboard’s sharing settings, but only Org Admins and Team Managers can change them.
|
Capability |
Org Admin |
Team Manager |
Individual User |
|---|---|---|---|
| View Overview, Dashboards, Explorer, and Logs | Supported | Supported | Supported |
| Share a dashboard with other users and teams | Supported | Supported | Not supported |
Requests
Team Managers and Individual Users send a request when they need a resource or access they don’t have. An Org Admin decides whether to approve each request.
|
Request |
Where to find it |
What you provide |
|---|---|---|
| Request a model | Models page | A provider and a model from the provider’s catalog. A reason is optional. |
| Request an MCP server | MCP servers page | A server from the library, or the URL of a server that is not in the library. A reason is optional. |
| Request an agent | Agents page | A display name, a type (A2A or HTTP), and the agent’s URL. A reason is optional. |
| Request access | The detail page of a model, MCP server, or agent | A reason, which is required. The request names the resource, its gateway, and your email address. |