Applies to:
- Plan -
- Deployment -
Summary
Goal: Understand why there is no export-specific permission in Braintrust and how to limit data access. Features: ACL permissions (create, read, update, delete, ACL management), project-scoped roles, API key controls.
No export-specific permission exists
Braintrust’s permission model does not have a dedicated export or download permission. The available permissions are:create,read,update,deletecreate_acls,read_acls,update_acls,delete_acls
read controls all data access. In the UI, download and export controls are hidden for users who have read but not update or delete. Programmatic export via the API and SDK is still available to any user with read, so read cannot be fully separated from export.
There is no configuration that fully prevents a user with read from exporting: even when the UI controls are hidden, that user can still export the same data through the API or SDK if issued an API key.
Limiting data access
Since export cannot be separated from read, the only way to restrict exports is to restrictread access itself.
Restrict by project or object
Assign users to custom permission groups scoped to specific projects or objects. This limits which data they can read — and therefore export.
The Viewer role grants read access across the organization and only restricts create, update, and delete. Viewers do not see UI download or export controls, but they retain programmatic export access through the API and SDK.
Restrict API-based bulk exports
No permission prevents a user with read access from making bulk API calls. To limit this:
- Control which users are issued API keys.
- Scope service account permissions to specific objects rather than the entire org.