How to Manage Users, Roles, and Tenants on a Private AI System?

Check Identity Before Model Request

The LLM endpoint should not manage its own passwords. An identity provider authenticates people and services using established protocols like OpenID Connect or OAuth 2.0. Keycloak uses realms as separate management spaces for users, credentials, roles, and groups. Whether a realm per organization or a shared realm with groups is sensible depends on the desired isolation, management, and operation.

A practical role model starts small: Users may use shared assistants, Editorial may maintain sources and tests, Administration manages models and the platform. Additional rights are granted per tool, such as reading documents, creating CRM records, or releasing models. Following the principle of least privilege, a token contains only the claims necessary for the current service.

Tenant separation must be consistent. The gateway determines the tenant ID from the verified identity and passes it as trusted context. The vector index filters every retrieval accordingly; for example, Qdrant supports tenant-related payload fields and corresponding indices. Database rows, caches, object storage, logs, and metrics require the same separation. A tenant ID freely entered by the user or an instruction in the prompt is not a security boundary.

For particularly sensitive or regulatory-separated assets, separate collections, databases, or instances may be appropriate. This increases isolation but also the effort for updates, backups, and monitoring. The decision is documented in a threat analysis. Service accounts receive short, rotatable credentials; interactive accounts are not used for automation. Role changes, logins, and privileged actions are logged in an auditable manner. Regular recertification, for example quarterly, is an organizational example and is adjusted to the organization's risk.