Give every team exactly the access they need

Role-based access control built into Cosmo. Assign permissions at organization, namespace, graph, and subgraph levels through a unified groups system that works for users and API keys alike.

No external IAM tools. No manual permission lists.

The problem

Managing access without roles creates sprawl

As organizations grow, manual permission management breaks down. Teams end up with too much access, and removing it requires knowing what each person was granted individually.

Individual permission management breaks at scale

Assigning permissions user by user becomes unmanageable as teams grow. Inconsistent access accumulates. Administrators spend time on manual updates instead of building.

Broad access creates risk

Without subgraph-level roles, the only safe option is either full access or no access. Teams end up with permissions to resources they should never touch.

No structure means permission drift

When permissions are not defined by roles, they accumulate over time. Users keep access long after they stop needing it. Security reviews become guesswork.

Our solution

Roles at every level of your graph

Enable RBAC in your organization settings. From there, roles apply at four levels — organization, namespace, graph, and subgraph — so you can give each team precisely scoped access. Groups unify permission management for users and API keys.

How access is structured

1. Enable RBAC in your organization settings.
2. Cosmo provides four organization-level roles: Admin, Developer, API Key Manager, and Viewer.
3. Namespace roles (Admin and Viewer) let you scope access to specific deployment environments.
4. Graph roles (Admin and Viewer) apply at the federated graph level.
5. Subgraph roles (Admin, Publisher, Checker, Viewer) provide the most granular control.
6. Assign roles through groups, which apply the same permission model to users and API keys.

Define roles once. Every group member inherits them automatically.

Before & After

Role hierarchy

Four levels, four role sets

• Organization: Admin, Developer, API Key Manager, Viewer
• Namespace: Admin, Viewer
• Graph: Admin, Viewer
• Subgraph: Admin, Publisher, Checker, Viewer

How Cosmo RBAC works

1. Enable
   Turn on RBAC in your organization settings. Once enabled, you can create and configure groups to manage access for your team.

2. Define roles
   Choose from organization, namespace, graph, and subgraph roles. Assign multiple roles per group to create complex access patterns without over-provisioning.

3. Assign groups
   Add users and API keys to groups. Members inherit all permissions from the group's rules. Change the group rules and every member's access updates immediately.

4. SSO role sync
   Connect SSO to synchronize role assignments with your identity provider. Users receive the correct roles based on mappings you define, without manual updates.

What's included

Role-based access for every part of your graph

Available on Scale and Enterprise plans.

Four-level role hierarchy

Roles at organization, namespace, graph, and subgraph levels. Each level has its own set of roles matched to the actions that make sense at that scope.

Unified groups

The same groups system manages access for organization members and API keys. One model, no divergence between human and automated access.

Built-in groups

Default admin, developer, and viewer groups are included out of the box. Create custom groups for teams that need specific combinations of roles and resource scopes.

SSO synchronization

Connect your OIDC identity provider and map IdP groups to Cosmo groups. Role assignments stay in sync with your authorization server automatically.

Set up role-based access control

Enable RBAC in your organization settings and define your first groups.