Project roles and permissions of AI Model Experiments

AI Model Experiments project roles

Role	Permissions	Title	Description
model-experiments.admin	model-experiments.instance.create, model-experiments.instance.delete, model-experiments.instance.get, model-experiments.instance.list, model-experiments.instance.login, model-experiments.instance.update, model-experiments.token.create, model-experiments.token.delete, model-experiments.token.get, model-experiments.token.list, model-experiments.token.update	Model Experiments Admin	Full administrative access to all model-experiments resources (instances and tokens) and operations.
model-experiments.reader	model-experiments.instance.get, model-experiments.instance.list, model-experiments.instance.login, model-experiments.token.get, model-experiments.token.list	Model Experiments Reader	Read-only access to view model-experiments resources (instances and tokens) and access the model-experiments UI.

AI Model Experiments Permissions to API Mapping

Permission	API Endpoint/s	Description
model-experiments.instance.create	/v1alpha/projects/[projectId]/regions/[regionId]/instances (POST)	Creates an AI Model Experiments instance in a project.
model-experiments.instance.delete	/v1alpha/projects/[projectId]/regions/[regionId]/instances/[instanceId] (DELETE)	Deletes an instance in a project.
model-experiments.instance.get	/v1alpha/projects/[projectId]/regions/[regionId]/instances/[instanceId] (GET)	Get an instances in a project.
model-experiments.instance.list	/v1alpha/projects/[projectId]/regions/[regionId]/instances (GET)	List all instances in a project.
model-experiments.instance.login		Grants access to the MLflow™ user interface.
model-experiments.instance.update	/v1alpha/projects/[projectId]/regions/[regionId]/instances/[instanceId] (PATCH)	Updates the name, description or deletion retention period of an instance in a project.
model-experiments.token.create	/v1alpha/projects/[projectId]/regions/[regionId]/instances/[instanceId]/tokens (POST)	Issues an authentication token for programmatic access to a specific instance.
model-experiments.token.delete	/v1alpha/projects/[projectId]/regions/[regionId]/instances/[instanceId]/tokens/[tokenId] (DELETE)	Revokes a specific access token for the given instance.
model-experiments.token.get	/v1alpha/projects/[projectId]/regions/[regionId]/instances/[instanceId]/tokens/[tokenId] (GET)	List a specific access token for a specific instance.
model-experiments.token.list	/v1alpha/projects/[projectId]/regions/[regionId]/instances/[instanceId]/tokens (GET)	Lists all access tokens for a specific instance.
model-experiments.token.update	/v1alpha/projects/[projectId]/regions/[regionId]/instances/[instanceId]/tokens/[tokenId] (PATCH)	Updates an access token description or name.