Skip to main content
Applies to:
  • Plan -
  • Deployment -

​
Summary

Goal: Understand why there is no export-specific permission in Braintrust and how to limit data access. Features: ACL permissions (create, read, update, delete, ACL management), project-scoped roles, API key controls.

​
No export-specific permission exists

Braintrust’s permission model does not have a dedicated export or download permission. The available permissions are:
  • create, read, update, delete
  • create_acls, read_acls, update_acls, delete_acls
read controls all data access. In the UI, download and export controls are hidden for users who have read but not update or delete. Programmatic export via the API and SDK is still available to any user with read, so read cannot be fully separated from export. There is no configuration that fully prevents a user with read from exporting: even when the UI controls are hidden, that user can still export the same data through the API or SDK if issued an API key.

​
Limiting data access

Since export cannot be separated from read, the only way to restrict exports is to restrict read access itself. Restrict by project or object Assign users to custom permission groups scoped to specific projects or objects. This limits which data they can read — and therefore export. The Viewer role grants read access across the organization and only restricts create, update, and delete. Viewers do not see UI download or export controls, but they retain programmatic export access through the API and SDK. Restrict API-based bulk exports No permission prevents a user with read access from making bulk API calls. To limit this:
  • Control which users are issued API keys.
  • Scope service account permissions to specific objects rather than the entire org.
Cloud storage automations Cloud storage export automations are an org-level admin feature and cannot be used to restrict user-initiated exports. See Export to cloud storage.