Team and access

Who can switch on the API Platform, create and manage inference keys, change gateway settings and add credit, how keys relate to organizations, and how key and billing changes are audited.

The API Platform runs inside your Safeguard workspace, with the members and roles you already have. This page covers who can do what, how keys relate to people and organizations, and where key actions are recorded.

Switching the API Platform on

Safeguard switches the API Platform on per workspace. Two switches matter:

Switch	What it does
API Platform (Console)	Puts the Console in your product switcher.
`console:inference_gateway`	Connects the Console to the inference gateway, lets members create inference keys, and lets the API accept your workspace's keys.

Both are off by default, and Safeguard turns them on. Ask Safeguard. While the API is in early access, the gateway can also be switched off as a whole. The Console then gives the reason "The inference API is not switched on for this deployment."

The gateway reads console:inference_gateway at most once a minute. If it cannot read the flag, it treats it as off.

Who can do what

Action	Who
Use the Console's Dashboard, Workbench, API keys and Usage pages	Members of a workspace where the API Platform is on
Create an inference key	Any active member except an auditor-only account, signed in as themselves
Edit or revoke a key in the Console	The key's owner. API keys lists only your own keys.
Run prompts in the Workbench	Members, except auditor-only accounts. Runs are charged to the workspace's credit.
See usage, the request log, the credit figures and the ledger	Any member. All of it covers the whole workspace.
Change Gateway settings	Tenant admins and super admins
Add credit by card, once card top-up is on	Tenant admins and super admins
Delete stored prompts	Tenant admins and super admins
Add credit as a grant	Safeguard
Deactivate a member, which revokes their keys	Members who manage members: tenant admins, and organization admins for members of the organizations they administer

Gateway settings are the workspace's monthly spend limit, Store prompts and outputs, Allow retries and fallbacks and Only use models whose provider offers zero data retention. Safeguard's billing service decides who may change them, buy credit or delete stored prompts: the workspace's tenant admins and super admins. The Console shows those controls only to them; everyone else sees the values read-only, with "A tenant administrator can change these."

Keys belong to people

A key is created by, and for, the member who is signed in. Nobody can create a key on someone else's behalf, and that includes Safeguard staff using the admin console.
A key acts for its owner. Every request made with it is charged to the workspace's credit.
A key works only while its owner is an active member. Deactivating a member revokes their keys in the workspace at once, and reactivating them does not bring the keys back. A member who is removed, suspended or locked out also stops their keys working.
Safeguard's authentication service also lets a tenant admin change or revoke another member's key, but the Console's API keys page lists only your own. To stop another member's keys from the Console, deactivate the member under Settings › Members.

Organizations

An inference key belongs to the whole workspace. It cannot be limited to an organization, project, product or agent.
Credit, monthly limits, usage and the request log are kept per workspace and per key, not per organization.
Every key can call every model available to the workspace.
To keep teams' spending apart, give each team its own keys, each with its own monthly limit, and compare them under Usage, By key.

Audit log

Safeguard writes an audit record for each of these actions. Key actions come from its authentication service; gateway settings, top-ups and deletions of stored prompts come from its billing service.

Action	Recorded as	With
Create a key	`auth.api.key.created`	The key's id, prefix and name
Change a key's name or limits	`auth.api.key.updated`, naming only the fields that changed, each with its old and new value. A save that changes nothing records nothing.	The key's id, prefix and name, and `changed` with `<field>From` and `<field>To` for each change
Revoke a key	`auth.api.key.revoked`	The key's id
Deactivate a member	`auth.account.disabled`	How many of the member's keys were revoked
Change Gateway settings	`inference.settings.updated`	Only the settings that changed, with old and new values, and the role it was made under (`Tenant_Admin` or `Super Admin`)
Start a card top-up	`inference.credits.checkout_started`	The credit, the charge and the card fee, and the role
Delete stored prompts	`inference.prompts.deleted`	How many were deleted, and the role

Every record also holds who acted, the workspace, the time, the IP address and the browser, and whether the action succeeded. The key itself is never recorded. When an access check refuses a key action, the refusal is recorded as a failure: for example, an auditor-only account trying to create a key, or a member trying to change someone else's key.

To read these records, open Settings › Security activity in ESSCM, if your workspace has it:

My activity shows your own events.
Organization activity shows everyone's, and only tenant admins see it. Type auth.api.key in the action filter and select Apply to list key events, or inference. to list gateway settings, top-ups and deletions of stored prompts.

Security activity shows IP addresses masked, with the country and region.

When Safeguard changes a feature for your workspace, such as switching console:inference_gateway on, the change appears in Organization activity too, naming the feature.