Skip to main content

Grant a group of workloads a shared Access Binding

Task

An Access Binding holds the models and MCP tools that workloads may use. Each Workload Blueprint selects exactly one, and a binding can be selected by many Blueprints. To give a group of workloads the same access, select one binding in their Blueprint, or in several Blueprints. When you later change the binding, every workload that uses it follows, after you review the impact.

Self-managed installations only

Workload Trust is available only in private, self-managed AIControls installations, on premises or in a cloud cluster that you run. It needs a dedicated cluster that you run, with Kyverno, Kyverno Runtime, and cluster OIDC and RBAC access in place. Nirmata-hosted (SaaS) workspaces don't include it. See Feature availability.

Before you begin​

  • You need an administrator session.
  • Know the servers, tools, and models the group needs. See Control MCP tool access.

Share a binding​

  1. Create the Blueprint that the workloads follow. In the Access section, choose Create a new Access Binding and add the grants under Allowed models and Allowed MCP tools. The binding's name defaults to the Blueprint's name. See Edit a Workload Blueprint.
  2. To share the binding with another Blueprint, create that Blueprint, or edit it, choose Use an existing Access Binding in its Access section, and select the binding. The section shows the grants and "Used by N Blueprints, M workloads."
  3. Register the workloads against the Blueprint, in Learn first (Audit).

Each workload that uses the Blueprint becomes a derived subject of the binding, so the binding's grants apply to it.

A workload that needs one more shared binding doesn't need a different Blueprint. Select Customize for this workload and choose the binding in More Access Bindings for this workload on the AI access tab. See Customize for this workload.

Change the grants for the whole group​

  1. Go to Setup → Settings → Access Bindings, open the binding's actions menu, and select Edit. You can also select Edit binding in a Blueprint's Access section.
  2. Add, change, or remove grants.
  3. Select Preview impact. The preview lists every Blueprint and workload the change reaches, with each one's mode, grants added and removed, and risks. For a change that gives Enforce workloads new access, the preview says so.
  4. Select Confirm and save.

The change applies to every workload at once, including workloads in Enforce, and AIControls records it in the configuration audit and in the binding's history. To undo it, restore the earlier revision. See Review and restore a binding change.

What the preview shows​

For the columns and the stale-preview behavior, see What the impact preview shows.

Last updated on