How to grant permissions to an account/How to add roles for a RAM user - Platform For AI

iTAG controls operation permissions for data annotation through three roles: Administrator, Labeling team leader, and Labeling worker. This keeps your data and workflow secure. After you assign a role to a RAM user or another Alibaba Cloud account, that account gains the corresponding permissions.

Role permissions

The following table lists the permissions for each role.

Role	Description	Permissions
Administrator	Creates datasets and labeling jobs, assigns them to team leaders or workers, then spot-checks the results and rejects any job that fails acceptance.	Log in to the administrator console. Log in to the labeling worker console. Manage personnel and assign tasks. Participate in the end-to-end labeling process.
Labeling team leader	Assigns labeling jobs and personnel. Can also handle labeling or quality inspection tasks assigned to them.	Log in to the labeling worker console. Manage personnel and assign tasks. Participate in the end-to-end labeling process.
Labeling worker	Handles the labeling or quality inspection tasks assigned to them.	Log in to the labeling worker console. Participate in the end-to-end labeling process.

Assign roles

RAM user

Add the RAM user as a workspace member. For more information, see Manage workspaces > Configure member roles.

Select the workspace role based on the following table.

iTAG role you plan to assign to the RAM user	Workspace member role you must select
Administrator, Labeling team leader, or Labeling worker	Administrator or labeling administrator
Labeling team leader or Labeling worker	Any role

In the left-side navigation pane, choose Data Preparation > iTAG. Click Personnel Management to open the Personnel Management tab under Management Center > Tenant Configuration.
Click Add Account and select Add Workspace Account.
In the Add Account dialog box, select the account and choose an Role. Click OK.

Available roles include labeling worker, labeling team leader, and administrator.

External account

Note

External accounts support only the Labeling team leader and Labeling worker roles.

In the left-side navigation pane, choose Data Preparation > iTAG. Click Personnel Management to open the Personnel Management tab under Management Center > Tenant Configuration.
Click Add Account and select Add Contractor Account.
In the Add Contractor Account dialog box, specify a Alias and the user's UID. Select an Role and click OK.

To find an account's UID, see How to view an account UID.

For Role, you can select labeling worker or labeling team leader.

FAQ

Q: Why can't I find my RAM user in the account list?

The RAM user must be a member of the current PAI workspace. To add members, see Manage workspaces > Configure member roles.

Q: How do I add external users as Labeling workers?

See Assign roles > External account to assign the Labeling worker role to these users.

Q: Can Labeling workers download raw data?

No. iTAG does not provide a direct download feature for Labeling workers. Raw data access is controlled by the permission policies of the storage service, such as Object Storage Service (OSS). Configure OSS permissions to manage data access.