Antfly Cloud uses separate controls for organization administration and instance data-plane access. Keep those concerns separate when creating users, groups, and automation keys.
Organization Administration
Organization access controls who can manage Cloud resources:
- organization settings
- members and invitations
- ownership transfer
- billing, subscriptions, spend limits, and usage
- audit logs
- organization-scoped management API keys
- Cloud instance lifecycle operations
Use organization roles for humans and management API keys for automation that provisions or administers Cloud resources.
Instance Access
Instance access controls what a principal can do inside a hosted Antfly instance. Principals can be users, groups, or Cloud API keys.
Grants can scope access by:
- table
- operation
- role level
- row-filter template
- principal type
This allows application keys to be narrower than organization administrators. For example, a read-only search service key can be limited to one table and one row-filter template.
Cloud API Key Types
CloudAPIKeyType has three values:
| Type | Use |
|---|---|
read_only | Query-only services and dashboards. |
read_write | Applications that need to index, update, and query data. |
admin | Automation that needs broad instance-level administration. |
Keys may be instance-scoped or management-scoped. Instance keys authorize proxied data-plane traffic. Management keys authorize Cloud control-plane workflows.
Groups
Groups let administrators grant access once and manage membership separately. They support:
- user membership
- SCIM-backed sync metadata
- group grants
- grant reuse across tables and keys
Use groups for humans and stable service teams. Use direct key grants for application-specific access.
Row Filters
Row filters restrict which rows a principal can access for a table. They are useful for multi-tenant application tables, department-level access, or customer-specific service keys.
When a request enters the Cloud proxy, the table-aware gateway applies grants and row filters before forwarding the request to the managed Antfly instance.