Skip to main content
Together uses role-based access control (RBAC) at both the organization and project level. Every member of an organization is assigned an organization role, and every collaborator of a project is assigned a project role.
Roles and permissions are being progressively rolled out across Together’s products and services. This page will be updated as more granular controls become available.

​
Organization roles

Organizations have two roles: admin and developer.
The creator (“owner”) of an organization is a special admin. They cannot be removed from the organization, their role cannot be changed from admin, and they cannot delete their own account.

​
Organization permissions

​
Roles and project visibility

A project’s visibility (open, closed, or private) controls which members can discover and join it. Your organization role affects what you can see:
  • Organization admins can see and join any project, but must join a closed or private project before accessing its resources or settings.
  • Organization developers must be added to a closed or private project by an admin.

​
Project roles

Projects have two roles: admin and editor.

​
Project permissions

Changing a project’s visibility between open, closed, and private takes effect immediately and keeps the project’s existing collaborators.

​
External collaborators (beta)

This feature is in beta. Contact support to enable it.
An external collaborator is someone who participates in a project without being a member of the project’s parent organization. They can be assigned any project role but have no organization-level permissions beyond seeing the organization’s name. What external collaborators can do:
  • Full access to any project they have been explicitly added to (based on their project role).
  • View their own profile settings.
What they cannot do:
  • Access billing settings.
  • View the organization members list.
  • See organization-level settings.

​
Product-specific permissions

​
GPU clusters (control plane)

The control plane covers infrastructure operations: creating, changing, and deleting clusters and volumes, and repairing nodes.

​
GPU clusters (data plane)

The data plane covers the work you do on clusters: accessing nodes, running jobs and workloads, and reading and writing volumes. To give an editor kubectl access to an OIDC-enabled cluster, a project admin creates a Kubernetes RBAC binding for the editor’s identity and shares the cluster’s OIDC kubeconfig, which contains no credentials.

​
Fine-tuning, endpoints, serverless inference & other products

Role-based access control for fine-tuning, endpoints, serverless inference, and other Together products is still being rolled out. Today, all project collaborators (both admins and editors) have full access to these services.

​
What’s coming

Together is actively rolling out RBAC across more services. Granular permissions for fine-tuning, dedicated model inference, and serverless inference are coming soon.
Have a specific RBAC requirement? Let us know. Customer feedback directly shapes Together’s roadmap.

Projects

Create workspaces and manage team access

Together's IAM Model

How users, credentials, and resources are organized