# Permission management

> Alibaba Cloud Model Studio provides granular access control at the console and model levels to support complex organizational structures spanning multiple regions.

<meta property="og:title" content="Permission management" />

## Identity and permission management <span id="2ed065c9409eu" />

A workspace is the smallest management unit for <strong>fine-grained permission control</strong> over models and users, and for [Alibaba Cloud cost allocation](/help/en/model-studio/permission-management-overview#23e1b216deked).

Model Studio uses three roles to manage workspace permissions:

1. <strong>Super administrator</strong>: Manages user permissions, available models, model <strong>rate limiting</strong>, and API keys across multiple workspaces.
2. <strong>Workspace administrator</strong>: Manages user permissions and resources within a specific <strong>workspace</strong>.
3. <strong>Regular user</strong>: Uses authorized resources.

<table style={{ display: "table", tableLayout: "fixed", width: "100%" }}><colgroup><col style={{ width: "24.95%" }} /><col style={{ width: "24.95%" }} /><col style={{ width: "25.05%" }} /><col style={{ width: "25.05%" }} /></colgroup><thead><tr><th><p><strong>Actions</strong></p></th><th><p><strong>Super administrator</strong> (with the <span>AliyunBailianFullAccess</span> system policy<strong>)</strong></p></th><th><p><strong>Workspace administrator</strong></p></th><th><p>Regular user</p></th></tr></thead><tbody><tr><td><p>Manage model calls and rate limiting</p></td><td><p>Supported</p></td><td><p>Not supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>Manage model fine-tuning</p></td><td><p>Supported</p></td><td><p>Not supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>Manage model deployment</p></td><td><p>Supported</p></td><td><p>Not supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>User management</p></td><td><p>Supported</p></td><td><p>Supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>Manage user page access</p></td><td><p>Supported</p></td><td><p>Supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>API key management</p></td><td><p>Supported</p></td><td><p>Supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>Use authorized workspaces, pages, and resources</p></td><td><p>Supported</p></td><td><p>Supported</p></td><td><p>Supported</p></td></tr><tr><td><p><a href="/help/en/model-studio/permission-management-overview#4adcb2854f9rv">OpenAPI permissions</a></p></td><td><p>Not supported</p></td><td><p>Not supported</p></td><td><p>Not supported</p></td></tr></tbody></table>

### Super administrator <span id="982297bd47p3i" />

A super administrator is one of the following account types:

- An Alibaba Cloud account. You can identify this account in the Model Studio console. Click the profile icon in the upper-right corner to open the account drop-down panel. The account with the <strong>Alibaba Cloud account</strong> label is the super administrator.
- A [RAM user](https://ram.console.alibabacloud.com/users) (account) with the AliyunBailianFullAccess (Model Studio Administrator) system policy can use the Global Management menu ([China (Beijing)](https://modelstudio.console.alibabacloud.com/settings/workspace) | [Singapore](https://modelstudio.console.alibabacloud.com/settings/workspace) | [US (Virginia)](https://modelstudio.console.alibabacloud.com/us-east-1/settings/workspace) | [Germany (Frankfurt)](https://modelstudio.console.alibabacloud.com/eu-central-1/settings/workspace)) of Model Studio to grant almost all permissions for any <strong>region</strong> and any <strong>workspace</strong> to any RAM user (including yourself). You can view the account information of the currently logged-in RAM user by clicking the profile picture in the upper-right corner of the Model Studio console to expand the account drop-down panel. (Only an Alibaba Cloud account can add [OpenAPI permissions](/help/en/model-studio/permission-management-overview#4adcb2854f9rv) | [China (Hong Kong)](https://modelstudio.console.alibabacloud.com/cn-hongkong/settings/workspace).)

  > A [RAM user](https://www.alibabacloud.com/help/en/ram/user-guide/overview-of-ram-users) is a sub-account created by an Alibaba Cloud account to securely delegate permissions for cloud resources to team members.

Super administrators can use Model Studio's global management menu ([China (Beijing)](https://modelstudio.console.alibabacloud.com/settings/workspace) | [Singapore](https://modelstudio.console.alibabacloud.com/settings/workspace) | [US (Virginia)](https://modelstudio.console.alibabacloud.com/us-east-1/settings/workspace) | [Germany (Frankfurt)](https://modelstudio.console.alibabacloud.com/eu-central-1/settings/workspace) | [China (Hong Kong)](https://modelstudio.console.alibabacloud.com/cn-hongkong/settings/workspace)) to manage multiple workspaces. The features include:

1. Create and rename workspaces.
2. Manage models and model rate limiting across all [workspaces](/help/en/model-studio/permission-management-overview#dac6676deelh2).
3. Manage accounts (users) for all workspaces.
4. Manage all API keys.

The [Add a workspace](/help/en/model-studio/permission-management-overview) section in this topic covers the full creation procedure, the workspace name and <strong>Region</strong> requirements, and the number of workspaces you can create per region.

<Note>
  An <strong>Alibaba Cloud account</strong> must perform a one-time activation in the console to enable features such as the [AI guardrails service](https://www.alibabacloud.com/help/en/document_detail/2923687.html) and [model monitoring](/help/en/model-studio/model-telemetry).
</Note>

### Workspace administrator <span id="c82f37c2033vw" />

A workspace administrator is an Alibaba Cloud [RAM user](https://ram.console.alibabacloud.com/users) who manages a specific workspace through the <strong>Permission Management</strong> page of that workspace.

> The <strong>Administrator</strong> permission grants access to all pages within the workspace.

In the <strong>Edit Permissions</strong> dialog box, click the <strong>Other</strong> tab, select <strong>Administrator</strong> from the list of permissions, and then click <strong>OK</strong>.

## Workspace permission management <span id="dac6676deelh2" />

Model Studio organizes resources and workspaces by region. <strong>A single workspace cannot span multiple regions. Even the default workspaces in different regions are distinct entities</strong>. You can switch regions in the global management menu ([Beijing](https://modelstudio.console.alibabacloud.com/settings/workspace) | [Singapore](https://modelstudio.console.alibabacloud.com/settings/workspace) | [Virginia](https://modelstudio.console.alibabacloud.com/us-east-1/settings/workspace) | [Frankfurt](https://modelstudio.console.alibabacloud.com/eu-central-1/settings/workspace) | [China (Hong Kong)](https://modelstudio.console.alibabacloud.com/cn-hongkong/settings/workspace)).

A workspace in Model Studio is the <strong>smallest</strong> administrative unit for <strong>fine-grained permission management</strong>, allowing you to manage:

<table style={{ display: "table", tableLayout: "fixed", width: "100%" }}><colgroup><col style={{ width: "24.95%" }} /><col style={{ width: "24.95%" }} /><col style={{ width: "25.05%" }} /><col style={{ width: "25.05%" }} /></colgroup><thead><tr><th><p><strong>Actions</strong></p></th><th><p><strong>Super administrator</strong> (with the <span>AliyunBailianFullAccess</span> system policy<strong>)</strong></p></th><th><p><strong>Workspace administrator</strong></p></th><th><p>Regular user</p></th></tr></thead><tbody><tr><td><p>Manage model calls and rate limiting</p></td><td><p>Supported</p></td><td><p>Not supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>Manage model fine-tuning</p></td><td><p>Supported</p></td><td><p>Not supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>Manage model deployment</p></td><td><p>Supported</p></td><td><p>Not supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>User management</p></td><td><p>Supported</p></td><td><p>Supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>Manage user page access</p></td><td><p>Supported</p></td><td><p>Supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>API key management</p></td><td><p>Supported</p></td><td><p>Supported</p></td><td><p>Not supported</p></td></tr><tr><td><p>Use authorized workspaces, pages, and resources</p></td><td><p>Supported</p></td><td><p>Supported</p></td><td><p>Supported</p></td></tr><tr><td><p><a href="/help/en/model-studio/permission-management-overview#4adcb2854f9rv">OpenAPI permissions</a></p></td><td><p>Not supported</p></td><td><p>Not supported</p></td><td><p>Not supported</p></td></tr></tbody></table>

- <strong>Restrict model calls</strong>: Manage whether a model can be <strong>called</strong> (from the console or via an API) and configure the model's <strong>Request Number Limit</strong> and <strong>Token Limit</strong>.

  > This restriction does not apply to the default workspace, where all models can be called without any throttling.

  In the <strong>model list</strong>, use the toggle in the <strong>Model Calling</strong> column to control the model's authorization status. In the <strong>Current Workspace Limit</strong> column, set the values and time units for the request number limit and token limit.
- <strong>Restrict model fine-tuning</strong>: Manage whether a model can be fine-tuned (from the console or via an API) and subsequently deployed within the workspace<strong>.</strong>

  > This restriction does not apply to the default workspace. There, all models that support fine-tuning can be fine-tuned and then deployed.

  On the <strong>Model List</strong> tab of the workspace, find the target model. In the <strong>Model Authorization</strong> area, use the toggle in the <strong>Model Training</strong> column to control the model's fine-tuning permission.
- <strong>Restrict model deployment</strong>: Manage whether a model can be <strong>deployed directly.</strong>

  > This restriction does not apply to the default workspace, where all models that support deployment can be deployed.

  On the <strong>Model List</strong> tab, the <strong>Model Deployment</strong> column in the <strong>Model Authorization</strong> area shows the deployment authorization status for each model. Use the toggle to switch the status between <strong>Authorized</strong> and <strong>Unauthorized</strong>.
- <strong>Manage console permissions for users</strong>: Control which <strong>console</strong> features a RAM user can access within a workspace. This does not affect API calls made with an API key that belongs to the user.

  > An Alibaba Cloud account does not require this setting and has access to all pages in all workspaces.

  In the <strong>Edit Permissions</strong> dialog box, select the <strong>Model</strong> tab. In the permission list, find and select the <strong>Model Experience - Operations</strong> permission. The <strong>Experience Center</strong> menu in the left navigation pane corresponds to the <strong>Model Experience - Operations</strong> permission in the list.

### API key permissions <span id="f2704153a055r" />

A single API key can only belong to one workspace and one user within a single region, and it cannot be transferred to other workspaces or users. The callable functions and model throttling for an API key are inherited from its <strong>Workspace</strong> permissions<strong>;</strong> these settings are independent of <strong>user console permissions</strong>, and you do not need to create different API keys for different models (such as text-to-text, text-to-image, or speech synthesis).

The following actions on the owner's account affect the status of the API key:

<Note>
  Starting March 25, 2026, all new API keys created in the <strong>China (Beijing)</strong> region belong to the Alibaba Cloud account.
</Note>

<table style={{ display: "table", tableLayout: "fixed", width: "100%" }}>
  <colgroup>
    <col style={{ width: "24.67%" }} />

    <col style={{ width: "29.54%" }} />

    <col style={{ width: "45.78%" }} />
  </colgroup>

  <thead>
    <tr>
      <th>
        <strong>Action</strong>
      </th>

      <th>
        <strong>Alibaba Cloud account</strong>
      </th>

      <th>
        <strong>RAM user</strong>
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        <strong>Manually delete an API key</strong>
      </td>

      <td>
        The key becomes invalid and cannot be recovered.Not supported
      </td>

      <td>
        The key becomes invalid and cannot be recovered.Not supported
      </td>
    </tr>

    <tr>
      <td>
        <strong>Remove the user from the workspace</strong>
      </td>

      <td>
        —
      </td>

      <td>
        The key becomes invalid.Not supported

        > The API key is reactivated if the user is added back to the workspace.
      </td>
    </tr>

    <tr>
      <td>
        <strong>Delete the user or role in the</strong>[RAM console](https://ram.console.alibabacloud.com/roles)
      </td>

      <td>
        —
      </td>

      <td>
        The key becomes invalid and cannot be recovered.Not supported
      </td>
    </tr>

    <tr>
      <td>
        <strong>Set an IP whitelist for the API key</strong>
      </td>

      <td>
        Supported for API keys in all regions. The US (Virginia) region supports IPv4 addresses only.
      </td>

      <td>
        Supported for API keys in all regions. The US (Virginia) region supports IPv4 addresses only.
      </td>
    </tr>
  </tbody>
</table>

To <strong>manage API keys</strong>, choose <strong>Account Management</strong> in the left-side navigation pane of the Model Studio console, find the target RAM user, and click <strong>Permission Management</strong>. There you can grant the RAM user permission to <strong>create, delete, and view all API keys</strong> in the workspace.

In the <strong>Edit Permissions</strong> dialog box, switch to the <strong>Other</strong> tab and select <strong>API key</strong>.

### OpenAPI permissions <span id="4adcb2854f9rv" />

By default, RAM users cannot call the OpenAPI for <strong>application</strong> features in Model Studio, including data, knowledge bases, prompt engineering, and long-term memory.

To grant these permissions, the <strong>Alibaba Cloud account</strong> must assign <strong>one of the following policies</strong> to the RAM user in the [RAM console](https://ram.console.alibabacloud.com/users):

- AliyunBailianDataFullAccess: Allows the user to call all APIs in the Model Studio application API catalog.
- AliyunBailianDataReadOnlyAccess: Allows the user to call <strong>read-only</strong> APIs in the Model Studio application API catalog, such as [DescribeFile - Query file status](/help/en/model-studio/api-bailian-2023-12-29-describefile) and [GetIndexJobStatus - Query the status of a knowledge base creation job](/help/en/model-studio/api-bailian-2023-12-29-getindexjobstatus).

For <strong>fine-grained permission control</strong> over the <strong>knowledge base</strong> and <strong>long-term memory</strong>, you can create a <strong>custom policy</strong> in the [RAM console](https://ram.console.alibabacloud.com/policies) that grants only the actions the RAM user needs.

<strong>Knowledge base</strong> actions: `sfm:CreateIndex`, `sfm:UpdateIndex`, `sfm:DeleteIndex`, and `sfm:SubmitIndexJob`. <strong>Long-term memory</strong> actions: `sfm:CreateMemory`, `sfm:UpdateMemory`, and `sfm:DeleteMemory`.

Example <strong>custom policy</strong>:

```json
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sfm:CreateIndex",
        "sfm:UpdateIndex",
        "sfm:DeleteIndex",
        "sfm:SubmitIndexJob",
        "sfm:CreateMemory",
        "sfm:UpdateMemory",
        "sfm:DeleteMemory"
      ],
      "Resource": "*"
    }
  ]
}
```

After you create the <strong>custom policy</strong>, attach it to the <strong>RAM user</strong> to grant the minimum CRUD permissions for the <strong>knowledge base</strong> and <strong>long-term memory</strong>. For the complete list of actions, see <strong>RAM authorization</strong>.

### Production strategies <span id="71f9018eafvb0" />

- <strong>Workspace planning strategy</strong>

  - <strong>Group by environment (Recommended):</strong> Create separate workspaces for development, testing, staging, and production environments to ensure strict environment isolation.

    - `project-dev-workspace`
    - `project-test-workspace`
    - `project-prod-workspace`
  - <strong>Group by business line:</strong> Create separate workspaces for different business units, such as marketing, after-sales, and design, to simplify permission and cost management.

    - `marketing-team-workspace`
    - `customer-team-workspace`
- <strong>Throttling policy</strong>

  - Allocate the total quota of your Alibaba Cloud account proportionally among workspaces and reserve a portion as a buffer to handle unexpected traffic spikes.

    <strong>Example:</strong> If the total account quota is 1,000 QPM, a possible allocation plan is as follows:

    - `project-prod-workspace`: 600 QPM (60%)
    - `project-test-workspace`: 200 QPM (20%)
    - `project-dev-workspace`: 100 QPM (10%)
    - Reserved buffer: 100 QPM (10%)

## Billing and subscription permissions <span id="23e1b216deked" />

By default, a RAM user does not have permission to view Alibaba Cloud bills or purchase subscription products. To do so, assign specific permissions to the RAM user in the [RAM console](https://ram.console.alibabacloud.com/users).

<Note>
  The following permissions enable a RAM user to <strong>view</strong> bills for <strong>all</strong> Alibaba Cloud products or <strong>purchase</strong> <strong>all</strong> Alibaba Cloud subscription products. Grant these permissions with caution.
</Note>

1. To enable a RAM user to view Alibaba Cloud bills, grant them the [AliyunBSSReadOnlyAccess permission](https://www.alibabacloud.com/help/en/user-center/ram-policies-for-billing-management#li-lj9-l6a-in1).
2. To enable a RAM user to purchase Alibaba Cloud subscription products, grant them the[AliyunBSSOrderAccess permission](https://www.alibabacloud.com/help/en/user-center/ram-policies-for-billing-management#li-q7v-rt1-xvi) .

<Accordion title="Fine-grained page permissions">
  <table style={{ display: "table", tableLayout: "fixed", width: "100%" }}><colgroup><col style={{ width: "25%" }} /><col style={{ width: "25%" }} /><col style={{ width: "25%" }} /><col style={{ width: "25%" }} /></colgroup><thead><tr><th><p>Menu</p></th><th><p>Submenu</p></th><th><p>AliyunBSSReadOnlyAccess</p></th><th><p>AliyunBSSOrderAccess</p></th></tr></thead><tbody><tr><td><p>Account Overview</p></td><td /><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Account Overview</p></td><td><p>Recharge</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Account Overview</p></td><td><p>Withdrawal</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Account Overview</p></td><td><p>Refund</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Account Overview</p></td><td><p>Apply for MYbank loan</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Account Overview</p></td><td><p>Apply for Alipay down payment tool</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Account Overview</p></td><td><p>View details</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Account Overview</p></td><td><p>Voucher management</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Account Overview</p></td><td><p>Resource plan management</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Account Overview</p></td><td><p>Request invoice</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Account Overview</p></td><td><p>Apply for contract</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Transaction Details</p></td><td /><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Usage Records</p></td><td><p>Usage Overview</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Usage Records</p></td><td><p>Usage Details</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Usage Records</p></td><td><p>Usage Records</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Usage Records</p></td><td><p>Instance Usage Details</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Usage Records</p></td><td><p>Monthly Cost Consumption</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Usage Records</p></td><td><p>Export Records</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Usage Records</p></td><td><p>Store to OSS</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Bill Analysis</p></td><td><p>Product Bill Analysis</p></td><td><p>View page. Operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Deposit Management</p></td><td /><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Order Management</p></td><td /><td><p>View page. No operations allowed.</p></td><td><p>View page. Operations allowed.</p></td></tr><tr><td><p>Voucher Management</p></td><td /><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Coupon Management</p></td><td /><td><p>Page not visible. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Stored-value Card Management</p></td><td /><td><p>Page not visible. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Redemption Voucher Management</p></td><td /><td><p>Page not visible. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Purchase Order</p></td><td /><td><p>Page not visible. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Resource Plan Management</p></td><td><p>Resource Plan Overview</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Resource Plan Management</p></td><td><p>Usage Details</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Invoice Management</p></td><td><p>Request Invoice</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Invoice Management</p></td><td><p>Invoice List</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Invoice Management</p></td><td><p>Invoice Information Management</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Invoice Management</p></td><td><p>Invoice Shipping Address Management</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Remittance Slip Management</p></td><td /><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Subscription Management</p></td><td><p>No-questions-asked refund within five days</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Subscription Management</p></td><td><p>Unsubscription Record</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Contract Management</p></td><td><p>Contract Application</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Contract Management</p></td><td><p>Contract Management</p></td><td><p>View page. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Availability Center</p></td><td /><td><p>Page not visible. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Renewal Management</p></td><td /><td><p>Page not visible. No operations allowed.</p></td><td><p>Page not visible. No operations allowed.</p></td></tr><tr><td><p>Purchase Page</p></td><td><p>Product Purchase Pages</p></td><td><p>View page. No operations allowed.</p></td><td><p>View page. No operations allowed.</p></td></tr></tbody></table>
</Accordion>

## Common settings <span id="9bb20e1217r4f" />

### Configure a super administrator <span id="6f98e93909xdj" />

> Only an Alibaba Cloud account (root account) or a RAM user with the AliyunRAMFullAccess system policy can perform this operation.

1. Go to the [RAM console](https://ram.console.alibabacloud.com/users) and grant the RAM user the AliyunBailianFullAccess (Model Studio administrator) and [AliyunBSSOrderAccess](https://www.alibabacloud.com/help/en/user-center/ram-policies-for-billing-management#h3-jp4-73a-2wi) (for purchasing Alibaba Cloud subscription products) permissions.
2. After granting these permissions, you can use the Model Studio global management menu ([China (Beijing)](https://modelstudio.console.alibabacloud.com/settings/workspace) | [Singapore](https://modelstudio.console.alibabacloud.com/settings/workspace) | [US (Virginia)](https://modelstudio.console.alibabacloud.com/us-east-1/settings/workspace) | [Germany (Frankfurt)](https://modelstudio.console.alibabacloud.com/eu-central-1/settings/workspace) | [China (Hong Kong)](https://modelstudio.console.alibabacloud.com/cn-hongkong/settings/workspace)) to manage permissions for any RAM user (including yourself) across all regions and workspaces, and to purchase Model Studio subscription products.

### Configure a workspace administrator <span id="6a1e5856a8xht" />

> This operation requires a super administrator or a workspace administrator.

1. In the left-side navigation pane of the Model Studio console, choose <strong>Account Management</strong>, find the target RAM user, click <strong>Permission Management</strong>, and grant the <strong>Administrator</strong> permission.

   In the <strong>Edit Permissions</strong> dialog box, switch to the <strong>Other</strong> tab, and then select <strong>Administrator</strong>.

### Configure model calling permissions <span id="f642213a1f38l" />

1. If you do not use the <strong>default workspace</strong>, ensure that the [model calling](/help/en/model-studio/permission-management-overview) permission is enabled for the specific model in the workspace. (This operation requires a super administrator.)
2. <strong>To call models from the Model Studio console</strong>, choose <strong>Account Management</strong> in the left-side navigation pane of the Model Studio console, find the target RAM user, click <strong>Permission Management</strong>, and grant the following permissions: (This operation requires a super administrator or a workspace administrator.)

   1. <strong>Playground-FullAccess</strong> to call models from the console.
   2. <strong>BatchInference-FullAccess</strong> to use the [batch inference](/help/en/model-studio/batch-inference) feature.
   3. <strong>ModelObservation-FullAccess</strong> to view the token consumption of model calls and evaluations.
3. <strong>To call models using the Model Studio API,</strong> create or assign an API key for the RAM user in the corresponding workspace. For more information, see [API key permissions](/help/en/model-studio/permission-management-overview#f2704153a055r). (This operation requires a super administrator or a workspace administrator.)

### Console permissions for model fine-tuning <span id="f2ca016a5ckjy" />

1. If you do not use the <strong>default workspace</strong>, ensure that the [model fine-tuning (training)](/help/en/model-studio/permission-management-overview) permission is enabled for the specific model in the workspace. (This operation requires a super administrator.)
2. In the left-side navigation pane of the Model Studio console, choose <strong>Account Management</strong>, find the target RAM user, click <strong>Permission Management</strong>, and grant the following model permissions: (This operation requires a super administrator or a workspace administrator.)

   1. <strong>Playground-FullAccess</strong> to call fine-tuned models from the console.
   2. <strong>ModelFine-tuning-FullAccess</strong> permission.
   3. <strong>MyModels-FullAccess</strong> to manage model snapshots after fine-tuning is complete.
   4. <strong>ModelDeployment-FullAccess</strong> to deploy fine-tuned models. You can call and evaluate a model only after deploying it.
   5. <strong>ModelEvaluation-FullAccess</strong> permission.
   6. <strong>DataManagement-FullAccess</strong> to manage fine-tuning datasets.
   7. <strong>ModelObservation-FullAccess</strong> to view the token consumption of model calls and evaluations.

### API permissions for model fine-tuning <span id="3572aec7e24te" />

1. If you do not use the <strong>default workspace</strong>, ensure that the [model fine-tuning (training)](/help/en/model-studio/permission-management-overview) permission is enabled for the specific model in the workspace. (This operation requires a super administrator.)
2. Create or assign an API key for the RAM user in the corresponding workspace. For more information, see [API key permissions](/help/en/model-studio/permission-management-overview#f2704153a055r). (This operation requires a super administrator or a workspace administrator.)

## FAQ <span id="e4fe0900fb8lr" />

### 1. Getting the workspace ID <span id="aac5b9bef24yb" />

For details, see [Get a workspace ID](/help/en/model-studio/obtain-the-app-id-and-workspace-id#732535cfc959h) in application development.

### 2. Call a model from a sub-workspace <span id="1ae3588d0ba5r" />

You can use the sub-workspace API key without any special configuration.

### 3. Use applications in a workspace <span id="7628d0d0df8vv" />

To call an application in a workspace via the API, you need the corresponding [APP ID and Workspace ID](/help/en/model-studio/obtain-the-app-id-and-workspace-id).

### 4. What should I do if a RAM user has AliyunBailianFullAccess but still cannot manage workspaces? <span id="f3a7b2c1d4e5k" />

RAM permissions (such as AliyunBailianFullAccess) and workspace-level permissions in Model Studio are two independent permission systems. RAM permissions only control access to the Model Studio console, whereas workspace management permissions (such as editing a workspace or managing members) must be separately granted by the Alibaba Cloud account or a super administrator in the Model Studio console.

If a RAM user already has the AliyunBailianFullAccess permission but still receives a permission-denied message when managing a workspace, perform the following steps:

1. Log on to the Model Studio console with the Alibaba Cloud account.
2. Click the settings icon in the upper-right corner and choose <strong>Account Management</strong> in the left-side navigation pane.
3. Find the RAM user to authorize and click <strong>Permission Management</strong>.
4. Grant the RAM user the management permission for the corresponding workspace.

### 5. How do I delete a workspace? <span id="89eb760f64x25" />

Go to the [Model Studio console](https://modelstudio.console.alibabacloud.com/cn-beijing/model/market), select the target region in the upper-right corner, navigate to [Workspace Management](https://modelstudio.console.alibabacloud.com/settings/workspace), and click <strong>Delete</strong> in the Actions column for the target workspace; or call the [DeleteWorkspace API](https://api.alibabacloud.com/document/ModelStudio/2026-02-10/DeleteWorkspace) (`DELETE /modelstudio/workspaces/{workspaceId}`). Only a workspace that contains no resources can be deleted, and you must enter the workspace ID to confirm the deletion. <strong>Deleted workspaces cannot be recovered.</strong>

### 6. How do I implement fine-grained permission control over the knowledge base and long-term memory? <span id="faq-custom-policy" />

You can create a <strong>custom policy</strong> in the [RAM console](https://ram.console.alibabacloud.com/users) that grants only the permissions needed for the required operations.

<strong>Knowledge base</strong> actions: `sfm:CreateIndex`, `sfm:UpdateIndex`, `sfm:DeleteIndex`, and `sfm:SubmitIndexJob`. <strong>Long-term memory</strong> actions: `sfm:CreateMemory`, `sfm:UpdateMemory`, and `sfm:DeleteMemory`.

Example <strong>custom policy</strong>:

```json
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sfm:CreateIndex",
        "sfm:UpdateIndex",
        "sfm:DeleteIndex",
        "sfm:SubmitIndexJob",
        "sfm:CreateMemory",
        "sfm:UpdateMemory",
        "sfm:DeleteMemory"
      ],
      "Resource": "*"
    }
  ]
}
```

After you create the <strong>custom policy</strong>, attach it to the <strong>RAM user</strong> to grant the minimum CRUD permissions for the <strong>knowledge base</strong> and <strong>long-term memory</strong>. For the complete list of actions, see <strong>RAM authorization</strong>.