Part 1 is the script — read it. Parts 2 and 3 are notes to review before you go on, not during.
Hello, everyone. My name is Renzo Nuccitelli. I'm a full-stack engineer on the Enterprise team here at Roboflow, and today I'm going to show you Enterprise Access Control.
Let's start with a scenario.
--------------------- Read Slides
Most workspaces start like this one. One person, and then you invite your colleagues by email.
On the basic plans, everyone you invite becomes an Admin. They can see and do everything in the workspace. And that's fine at the beginning — you still control who gets in and who gets out.
But this breaks down as the company grows. Say someone leaves. You revoke their corporate credentials, and then you have to remember to remove them from Roboflow as well. That's two places. Now multiply that by every product your team uses. And you do the same work in reverse every time someone joins.
The standard solution to this is single sign-on. Let me show you how it works in Roboflow.
--------- Navigate to SSO Tab, show domain and connection config
I've already set mine up. My organization uses the email domain dev.pro.br, with Google OpenID Connect.
Now let's see what this changes. Right now I'm the only member of this workspace, with my Roboflow email. But I want my twin brother, who works at Dev Pro, to join.
And here he is. He's in the workspace automatically. I never sent him an invite.
This is the important part. His credentials live in the identity provider, under the organization's control. If he leaves the company, you revoke his account there, and his access to Roboflow is gone with it. One place, not two.
So he's in. But look at what he can see. Team Members. API Keys. Everything.
If he's the labeling vendor from my opening scenario, that doesn't make any sense. He only needs to label images.
This is where roles come in. Roboflow has three system roles.
Admin has every permission — they see and do everything. Labeler is the person who labels your images. And Reviewer reviews the work the labeler has done; a reviewer can also add images to the dataset, and label images themselves.
Let me change my brother to Labeler. And now, back in his window, I'll refresh.
Look at the difference. The navigation is much smaller. He has access to the projects, and he can annotate. That's it. Everything else is gone.
Three roles work well for a small team. But as more people join, three is usually not enough. So Roboflow also has custom roles.
------------- hoe role, permissions and atribtutint
One more thing here. You can set a default role. That's the role a person gets the first time they join your workspace. A common practice with enterprise customers is to make the default very restrictive, and then grant more access as needed
Now let me go back to the Labeler.
The Labeler role is quite limited — this person can only label. But watch this. They can still see this restricted project.
That's because a role controls what you can do, not what you can see. For that, Roboflow has folders.
With folders, you control who can access the projects inside a folder or a subfolder. Let me restrict this one.
-------- Do and explain
Of course, you can also grant access explicitly. If I want my brother to work on this folder, I add him here, and I save.
-------- Do and explain
And the same folder structure applies to workflows, not only to projects.
One more thing worth mentioning. Your identity provider almost certainly has groups already — managers, labelers, whatever your organization uses. You can map those groups to roles and to folder access. So when someone logs in, they land in the right role, with the right access, automatically. You manage the group in your identity provider, and Roboflow follows.
-------- Do and explain So that finishs how Roboflow does Role Base Access Control
Now let's talk about workflows. Workflows are how you run your models in Roboflow.
Here's a common enterprise policy: the company does not allow sending its data to an external AI provider. No sending images or text to an Agents.
And Roboflow has blocks that do exactly that.
---------- Show block available and get back
This block sends a prompt and your data to an external model provider. Under that policy, this block should not be available to anyone in the workspace.
So let me show you how you control that.
-------- Do and explain control, just show disable block
So the policy is enforced by the platform. Not by a document that people are supposed to remember.
Everything I showed you so far prevents things from happening. This last part is how you answer questions after they happen.
Why would you need that? First of all: Compliance — SOC 2, ISO norms, and customer security reviews all ask you to show that access is controlled and that changes are recorded. Investigation, when something changed and you need to know who changed it. And access reviews, when you need the history, not just the current state.
This is the Audit Logs page.
-------- Do and explain control
Now, large companies usually don't want to log into another tool to read this. They have a SIEM — Security Information and Event Management. Datadog, Honeycomb, Splunk.
If your SIEM accepts OpenTelemetry, which is the standard today, you can export these events straight into it. So when one of these events happens here, it arrives in your system. And then you can reuse everything you already built — including the alert that posts to a Slack channel when something sensitive changes.
So let me go back to our five questions form the beginning
--- Go back to slides
That's Enterprise Access Control. I'm happy to take your questions.
Do not click Send Invite on the SSO workspace. That's the bug filed as ENT-1737. On a WorkOS SSO workspace the invite form still renders, but the backend always rejects it with "Unauthorized access to workspace". Do the email-invite part on the non-SSO workspace at the beginning, before switching over.
Rename the "No Access" custom role. The role selector in the invite box already has an option literally called "No Access", so a custom role with the same name will confuse people. Call it "Restricted" or "New Joiner".
| Said in rehearsal | Say instead |
|---|---|
| "RBAC, Role Access Control" | Role-Based Access Control |
| "Secured Information and Event Management" | Security Information and Event Management |
| "attribute a role to an user" | assign a role to a user |
| "you have provided access" | you have granted access |
| "a recording that you trail" | an audit trail / a record |
| "what users have done into your website" | in your workspace |
| "contact an administrator to admit it" | to enable it |
"already" came out as "a RAD" and "ready" several times — "if you're ready to have that" should be "if you already have that." It's three syllables: all-RED-y /ɔːlˈredi/. Slow it down.
"review" vs "reveal" — the rehearsal had "the one that is going to reveal the work." Review is /rɪ-VYOO/, reveal is /rɪ-VEEL/. Different words, and this talk needs review a lot.
"a user", not "an user" — the u here sounds like you, a consonant sound.
People take "who", not "that" — the people who are invited, the one who reviews the work.
After "to", use the base verb — "having to manage people", not "to managing". Same for "you are able to map the SSO groups", not "to mapping".
Users are "they" — the switch to "it" crept in: "this user entered the workspace, but it can access everything" → "but they can access everything."
"That's two jobs" — "two works" doesn't work; work doesn't take a plural like that. Alternatives: "that's double the work", "that's two places to remember."
Four crutches: "a bunch of", "and so on" / "and stuff like that", "pretty much", and "So" opening almost every sentence.
Swaps: a bunch of → a lot of, dozens of, or a real number. And so on → just stop the list; three items is enough. Pretty much → basically, or delete it. For So, try Now, Next, Here's the thing, or simply a pause — silence sounds more confident than "so".
Leverage appeared three times in one sentence at the end. Use it once: "you can reuse the alerting you already have."
Pre-write only the transitions. The demo narration is good and natural — it's the connective sentences between sections where the stalls happen. Memorize those five.
Pause instead of filling. The "uh" almost always lands where a silent beat would be stronger. When the word is missing, stop and breathe. It reads as thinking, not as struggling.
Time yourself. The second run was about 25 minutes with several long silences during navigation. Know the slot, and know which section to cut if running long — custom roles compresses most easily.