MLflow
Experiments, runs, models, traces, workspaces and webhooks.
AI Viewer and AI Builder are MLflow functional roles. AI Viewer grants experiment, run, registry and trace reads; AI Builder includes those reads and the supported writes. Tenant administration alone does not grant those functional permissions.
Prompts and logged models use mlflow.model.*. Evaluation datasets use mlflow.experiment.*. Some compound operations require two permissions, such as linking a prompt version to a run (mlflow.model.update and mlflow.run.update).
Workspace and webhook permissions use a different rule: membership supplies the operation gate, while workspace access decides the result. Current members can read their tenant's workspaces. The workspace owner, tenant administrator or platform administrator can manage the workspace and its webhooks, subject to the API's tenant-context checks. Creating a workspace requires mlflow.workspace.create.
Workspace management does not redirect experiment, run, registry or trace APIs into that workspace. Those APIs use MLflow's default workspace; webhooks are workspace-aware. The permissions listed here are not a claim that every MLflow entity is isolated by workspace.
Deleting experiments and runs is reversible through their restore operations, which require the corresponding delete permission. Registry deletion is permanent. Model promotion changes stages or aliases; runtime deployment requires the separate platform permission.
Permissions
This family contains 30 permissions. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.
mlflow.experiment.create
Create an MLflow experiment or an associated evaluation dataset through the supported API.
Create an MLflow experiment or an associated evaluation dataset through the supported API.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.experiment.list, mlflow.experiment.read |
mlflow.experiment.delete
Soft-delete or restore an experiment, or delete an associated evaluation dataset through its API.
Soft-delete or restore an experiment, or delete an associated evaluation dataset through its API. Dataset deletion is distinct from experiment soft deletion.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.experiment.list, mlflow.experiment.read, mlflow.experiment.update |
mlflow.experiment.list
List or search visible MLflow experiments.
List or search visible MLflow experiments.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Viewer, AI Builder |
| Custom role | Yes |
| Also implies | mlflow.experiment.read |
mlflow.experiment.read
Read an experiment and its supported evaluation-dataset information.
Read an experiment and its supported evaluation-dataset information.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Viewer, AI Builder |
| Custom role | Yes |
mlflow.experiment.update
Change experiment metadata or associated evaluation-dataset tags and experiment associations.
Change experiment metadata or associated evaluation-dataset tags and experiment associations.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.experiment.list, mlflow.experiment.read |
mlflow.model.create
Create registered models or versions, prompt versions, or logged models through supported APIs.
Create registered models or versions, prompt versions, or logged models through supported APIs.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.model.list, mlflow.model.read |
mlflow.model.delete
Permanently delete registry objects or versions through supported APIs.
Permanently delete registry objects or versions through supported APIs. This is not experiment or run soft deletion.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.model.list, mlflow.model.read, mlflow.model.update |
mlflow.model.list
List or search registered models, prompt registry entries and logged models through supported APIs.
List or search registered models, prompt registry entries and logged models through supported APIs.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Viewer, AI Builder |
| Custom role | Yes |
| Also implies | mlflow.model.read |
mlflow.model.promote
Manage model-version stages or aliases and supported prompt aliases.
Manage model-version stages or aliases and supported prompt aliases. This does not deploy a model to the inference runtime.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.model.list, mlflow.model.read |
mlflow.model.read
Read registry objects, their versions and supported metadata.
Read registry objects, their versions and supported metadata.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Viewer, AI Builder |
| Custom role | Yes |
mlflow.model.update
Change registry metadata, tags or supported logged-model state.
Change registry metadata, tags or supported logged-model state.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.model.list, mlflow.model.read |
mlflow.run.create
Create a run in an accessible experiment.
Create a run in an accessible experiment.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.run.list, mlflow.run.read |
mlflow.run.delete
Soft-delete or restore an MLflow run.
Soft-delete or restore an MLflow run.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.run.list, mlflow.run.read, mlflow.run.update |
mlflow.run.list
List or search runs in visible experiments.
List or search runs in visible experiments.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Viewer, AI Builder |
| Custom role | Yes |
| Also implies | mlflow.run.read |
mlflow.run.read
Inspect a run's metrics, parameters, tags and accessible artifacts.
Inspect a run's metrics, parameters, tags and accessible artifacts.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Viewer, AI Builder |
| Custom role | Yes |
mlflow.run.update
Change run metadata or lifecycle state, log parameters and metrics, or upload artifacts through supported operations.
Change run metadata or lifecycle state, log parameters and metrics, or upload artifacts through supported operations.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.run.list, mlflow.run.read |
mlflow.trace.delete
Delete individual traces or a selected batch of traces.
Delete individual traces or a selected batch of traces.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.trace.list, mlflow.trace.read, mlflow.trace.update |
mlflow.trace.list
Search traces in accessible experiments.
Search traces in accessible experiments.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Viewer, AI Builder |
| Custom role | Yes |
| Also implies | mlflow.trace.read |
mlflow.trace.read
Read trace details and trace assessments.
Read trace details and trace assessments.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Viewer, AI Builder |
| Custom role | Yes |
mlflow.trace.update
Change trace tags, link traces to runs, or create, update and delete trace assessments.
Change trace tags, link traces to runs, or create, update and delete trace assessments.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | AI Builder |
| Custom role | Yes |
| Also implies | mlflow.trace.list, mlflow.trace.read |
mlflow.webhook.create
Create a webhook in an administrable workspace.
Create a webhook in an administrable workspace.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Baseline tenant membership; access is decided on the individual MLflow workspace. |
mlflow.webhook.delete
Delete a webhook in an administrable workspace.
Delete a webhook in an administrable workspace.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Baseline tenant membership; access is decided on the individual MLflow workspace. |
mlflow.webhook.list
List webhooks in a workspace the caller is authorized to administer.
List webhooks in a workspace the caller is authorized to administer.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Baseline tenant membership; access is decided on the individual MLflow workspace. |
| Also implies | mlflow.webhook.read |
mlflow.webhook.read
Read a webhook in an administrable workspace.
Read a webhook in an administrable workspace.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Baseline tenant membership; access is decided on the individual MLflow workspace. |
mlflow.webhook.update
Change or test a webhook in an administrable workspace.
Change or test a webhook in an administrable workspace.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Baseline tenant membership; access is decided on the individual MLflow workspace. |
mlflow.workspace.create
Create an MLflow workspace associated with the active tenant.
Create an MLflow workspace associated with the active tenant. The creator receives ownership.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Tenant administrator |
| Custom role | Yes |
mlflow.workspace.delete
Delete an MLflow workspace only when the caller has workspace-level delete authority.
Delete an MLflow workspace only when the caller has workspace-level delete authority.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Baseline tenant membership; access is decided on the individual MLflow workspace. |
mlflow.workspace.list
List MLflow workspaces the caller can access.
List MLflow workspaces the caller can access.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Baseline tenant membership; access is decided on the individual MLflow workspace. |
| Also implies | mlflow.workspace.read |
mlflow.workspace.read
Read an accessible MLflow workspace.
Read an accessible MLflow workspace.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Baseline tenant membership; access is decided on the individual MLflow workspace. |
mlflow.workspace.update
Update an MLflow workspace only when the caller has workspace-level update authority.
Update an MLflow workspace only when the caller has workspace-level update authority.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Baseline tenant membership; access is decided on the individual MLflow workspace. |