Scenario: Team Access Control
Control who can see data and administer the gateway without giving everyone admin-level access. Axemere uses Clerk organization membership for identity: role-based permissions map to viewer (read-only) and admin (read-write) levels in the console and API.
Roles
| Role | Console access | API access |
|---|---|---|
| Admin | Full access: all pages, create/edit/delete | All /v1/admin/ endpoints + read |
| Viewer | Read-only: dashboard, records, reports | Read endpoints only |
Roles are assigned per organization membership in the console. All members of your org have at least Viewer access. Admins can promote members to Admin.
Adding a team member
- Go to Team & Billing in the left nav
- Click Invite Member
- Enter the member's email address
- Select Viewer or Admin as their role
- Click Send Invitation
The invitee receives an email with a magic link. Once they sign in, they are added to your org with the assigned role.
See the Team guide for managing pending invitations and removing members.
Using workload attribution for team separation
Roles grant console access but do not restrict which workloads an application can call. To isolate team usage within a shared gateway, assign each team a dedicated workload and project in the console.
- Go to Workloads in the left nav
- Click Add Workload and create a workload per team (e.g.
wl-datascience,wl-engineering) - Assign each workload to its own project under Projects
Each team's application sends its own workload identifier on requests. Records, spend, and policy rules apply per-workload: the data science team's budget cap doesn't affect the engineering team, and their request history is visible separately in Records.
Restricting admin token access
The MVGC_ADMIN_TOKEN is a gateway-level credential that grants full admin access to the
admin API. Treat it like a root password:
- Store it in a secrets manager (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault)
- Do not embed it in application code or environment files committed to version control
- Rotate it if exposed; see the Credential Rotation scenario
- Use Viewer-role console access for day-to-day monitoring; reserve admin token use for configuration changes
Reviewing access
Audit org membership from the console under Team & Billing. The team page shows all current members, their roles, and any pending invitations.
Related Topics
- Team guide — invitations, role changes, removing members
- Settings guide — org-level configuration
- Credentials guide — storing provider keys securely