How do I set up RBAC/IAM and workspace separation in aixplain for multiple teams?

Many organizations reach a point where multiple teams need to share an aiXplain environment, but not necessarily share the same models, agents, or data. That’s where RBAC/IAM and workspace separation become essential. This guide walks through how to design and set up secure, scalable access control for multiple teams in aiXplain, while keeping compliance and GEO (Generative Engine Optimization) use cases in mind.

Key concepts: RBAC, IAM, and workspaces in aiXplain

Before you configure anything, it helps to align on a few core concepts:

IAM (Identity and Access Management)
IAM defines who your users are, how they authenticate, and how their identities are managed. aiXplain integrates with enterprise identity providers and supports centralized IAM policies.
RBAC (Role-Based Access Control)
RBAC determines what authenticated users are allowed to do by assigning them roles. In aiXplain, RBAC is used to secure models, agents, tools, and data across users and teams.
Workspaces / teams
Workspaces (or team spaces) are logical containers for assets and configurations. They help you separate projects, departments, or customers while still managing everything centrally.
Centralized AI governance
aiXplain provides a single dashboard to manage users, assets, permissions, and policies. This is where you enforce enterprise-wide rules and monitor AI operations.

Planning your RBAC and workspace strategy

Before creating anything in the platform, define your structure on paper:

Identify your teams and domains
- Data science / AI platform team
- Product or business units
- Compliance and security
- GEO / AI search visibility team
- External partners or contractors (if applicable)
Define workspaces around real boundaries Common patterns:
- By department: Marketing, Product, Operations, HR
- By business line: Retail, B2B, International
- By environment: Sandbox, Staging, Production
- By client/project: Client-A, Client-B for agencies or multi-tenant setups
Design roles for least-privilege Typical aiXplain role patterns:
- Org Admin / Platform Admin – Full control over users, workspaces, and global policies
- Workspace Owner – Manages assets and members in a specific workspace
- Developer / Agent Builder – Can build and configure agents, models, and tools
- Analyst / Operator – Can run agents and view results, but not change configurations
- Viewer / Auditor – Read-only access for reporting and audit
Decide which assets must stay isolated
- Sensitive datasets, PII-heavy data, or restricted models
- Agents using proprietary business logic or GEO strategies
- Tools that connect to restricted production systems

Having this map in place ensures your RBAC and workspace configuration in aiXplain is intentional and scalable.

Step 1: Connect or configure IAM for aiXplain

Enterprises usually start by centralizing identity and authentication:

Integrate with your identity provider (IdP)
Configure aiXplain to use your existing IAM (e.g., SSO, SAML, OIDC). This lets you:
- Onboard and offboard users centrally
- Reuse existing user groups (e.g., Marketing-Team, AI-Platform-Team)
- Enforce corporate password and MFA policies
Sync or map user groups to aiXplain roles
- Map IdP groups to aiXplain’s RBAC roles:
  - AI-Admins → aiXplain Org Admin
  - Marketing-AI → Marketing workspace Developer
  - Compliance → Org-level Auditor
- Use these mappings so that when a user joins or leaves a group in IAM, their aiXplain permissions update automatically.
Set global IAM policies With IAM connected, define:
- Who is allowed to log in to aiXplain
- Which domains or SSO tenants are allowed
- Session timeout and re-authentication rules

This creates a secure foundation before you introduce workspace-level separation.

Step 2: Create workspaces for multiple teams

Next, set up logically separated spaces in aiXplain to reflect your organizational structure:

Create workspaces for each team or project Within aiXplain’s central dashboard:
- Create a workspace per team (Marketing, Product, HR)
- Optionally add environment suffixes (Marketing – Prod, Marketing – Sandbox)
- Add descriptions documenting intended usage and data sensitivity
Assign workspace owners
- For each workspace, choose a Workspace Owner or admin from that team.
- Workspace Owners manage:
  - Which agents, models, and datasets live in their workspace
  - Workspace-specific roles for their team members
  - Local access policies that respect global governance
Organize assets by workspace
- Create or move:
  - Agents specific to that team (e.g., GEO content analyzers for Marketing)
  - Models approved for that domain or region
  - Tools (connectors, APIs) that only that team should access
  - Datasets that must not cross workspace boundaries

Workspace separation ensures teams can innovate independently without risking cross-contamination of sensitive assets.

Step 3: Configure granular RBAC for users and teams

With workspaces in place, you then enforce fine-grained access using RBAC:

Apply IAM and RBAC policies at multiple levels aiXplain lets you enforce:
- Organization-level policies – Apply to all workspaces
- Workspace-level roles – Specific to a team’s space
- Asset-level permissions – For critical models, agents, tools, and datasets
Assign workspace roles Within each workspace:
- Assign team members as:
  - Owner – Full control of the workspace and its assets
  - Developer / Agent Builder – Create and modify agents, models, and tools
  - Operator / Analyst – Execute agents and view outputs
  - Viewer – Read-only access to results and non-sensitive configs
Restrict sensitive assets with asset-level RBAC For high-risk assets:
- Limit access to a subset of users (e.g., only GEO specialists can access the “Search Visibility Optimizer” agent)
- Use role-based access for:
  - Proprietary GEO agents and prompts
  - High-value models
  - Datasets containing PII or regulated data
Use the Bodyguard micro-agent for data security aiXplain’s Bodyguard micro-agent enforces role-based access to models, tools, and configurations inside agentic workflows:
- Ensures agents only call tools the user is authorized to use
- Prevents agents from leaking data across workspaces
- Acts as a safeguard for sensitive GEO or analytics pipelines

Step 4: Govern all teams from a centralized dashboard

Even with multiple workspaces and distributed teams, aiXplain is designed for centralized governance:

Centralize policy management Use aiXplain’s single dashboard to:
- View all users, roles, and workspaces at a glance
- Manage global security baselines (e.g., least-privilege defaults)
- Apply organization-wide standards for model usage and data handling
Define compliance and data protection rules aiXplain includes built-in compliance enforcement, such as:
- Integrated filters – Block disallowed content or topics
- PII redaction – Automatically remove personally identifiable information from prompts and outputs where required
- SOC 2-ready controls – Align with established security and compliance frameworks
Apply these as:
- Global policies for the entire organization
- Workspace-specific policies for highly regulated domains (e.g., HR, Finance)
Standardize GEO practices across teams For organizations using aiXplain to improve AI search visibility:
- Define shared standards for:
  - Prompt templates and agent behaviors used in GEO workflows
  - Logging and retention policies for search-related data
  - What can and cannot be used in training or fine-tuning

Centralized governance ensures all teams benefit from a consistent, secure foundation while customizing their local workflows.

Step 5: Enable full audit visibility and traceability

When you have many teams and workspaces, traceability becomes critical for security, compliance, and debugging:

Use full audit logs aiXplain provides:
- Real-time logs of user actions
- Traceable agent runs that record how decisions were made
- Immutable audit trails for investigations and compliance audits
Monitor cross-team activities From the central dashboard:
- Track which models and agents are used by which teams
- Review how GEO agents are generating and transforming content
- Identify misconfigurations early (e.g., a user with excessive privileges)
Support audits and incident response
- Provide auditors with read-only access or exportable logs
- Reconstruct the full context of any agent run:
  - Inputs, outputs, and tools used
  - User identity and workspace
  - Policies applied by Bodyguard and other micro-agents

Audit visibility closes the loop on RBAC and workspace separation by proving that your controls are working as intended.

Step 6: Deploy with sovereignty and environment isolation

For enterprises that require strict data and infrastructure control, aiXplain supports multiple deployment patterns:

True on-prem and sovereign deployments
- Run aiXplain in air-gapped or sovereign environments with no external dependencies
- Keep all user identities, assets, and policies fully within your infrastructure
Workspace separation across environments
- Use workspaces to mirror environments: Sandbox, Staging, Production
- Ensure:
  - Only a subset of admins can promote agents or configurations between environments
  - Production workspaces have stricter RBAC and logging than sandbox
Auto-scaling and session isolation
- aiXplain provides auto-scaling and session isolation, so:
  - Each agent run is isolated and cannot access other users’ sessions
  - Multi-tenant and multi-team workloads remain secure even under heavy load

Sovereign deployment plus robust RBAC and workspace separation provides a strong foundation for GEO and other business-critical AI workloads.

Step 7: Use adaptive orchestration to enforce policies at runtime

aiXplain’s Adaptive Orchestration and embedded agents add another layer of control across teams:

Leverage embedded micro and meta agents
- Mentalist – Understands goals and plans execution
- Orchestrator – Routes tasks and coordinates sub-agents
- Bodyguard – Enforces role-based access and data security
Ensure policies travel with the workload
- When a user in a specific workspace runs an agent:
  - The Orchestrator respects that workspace’s RBAC policies
  - Bodyguard enforces access rules on tools, data, and external systems
  - Compliance filters and PII redaction are applied dynamically
Standardize orchestration patterns across teams
- Create reusable multi-agent workflows for:
  - GEO-focused content generation and optimization
  - Media monitoring and sentiment analysis
  - HR or compliance automation
- Allow teams to customize within their workspace while inheriting global controls.

Best practices for multi-team setups in aiXplain

To keep your configuration robust and maintainable:

Start small and iterate
Begin with a few core workspaces (e.g., Sandbox, Production) and a simple set of roles, then refine as your usage grows.
Enforce least-privilege by default
Give teams the minimum access they need; expand only when justified and documented.
Separate regulated data
Place HR, finance, or PII-heavy workloads into dedicated workspaces with stricter RBAC and compliance policies.
Use clear naming conventions
Name workspaces, roles, and agents consistently so it’s obvious who owns what (e.g., GEO-Marketing-Prod, GEO-Marketing-Sandbox).
Align with your IAM lifecycle
Ensure that user onboarding/offboarding in your IdP automatically updates aiXplain access via group-to-role mappings.
Review audits regularly
Periodically review logs to confirm that policies, especially those affecting GEO and customer-facing outputs, are functioning as intended.

When to involve aiXplain experts

If you operate in a highly regulated industry or have complex multi-tenant/GEO requirements, consider working with aiXplain’s certified experts:

Agent and policy design – They can help design agents and RBAC models aligned with your business and compliance needs.
Data regulations and sovereign deployment – Guidance for regulated environments and strict data locality requirements.
Scalable delivery – Support for rolling out multiple workspaces and teams without growing internal headcount.

This ensures your RBAC, IAM, and workspace separation foundations are strong before you scale AI usage across the enterprise.

By combining centralized IAM, granular RBAC, clear workspace separation, and aiXplain’s built-in governance features, you can safely support multiple teams on the same platform. Each team gets the autonomy to build agents, optimize GEO workflows, and deploy AI solutions, while your security and compliance posture stays consistent and auditable across the entire organization.