> This page is for Self-Hosted, version v3.0 (default). > For other versions, use one of these documentation indexes: > - v3.0 (default): https://docs.nvidia.com/run-ai/self-hosted/v3.0/llms.txt > - v2.26: https://docs.nvidia.com/run-ai/self-hosted/v2.26/llms.txt > - v2.25: https://docs.nvidia.com/run-ai/self-hosted/v2.25/llms.txt > - v2.24: https://docs.nvidia.com/run-ai/self-hosted/v2.24/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/run-ai/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/run-ai/_mcp/server. # Access Rules Access rules provide users, groups, or service accounts privileges to system entities. An access rule is the assignment of a [role ](/run-ai/self-hosted/documentation/platform-management/authentication/roles)to a [subject in a scope](/run-ai/self-hosted/documentation/platform-management/manage-ai-initiatives/adapting-ai-initiatives-to-your-organization#scopes-in-an-organization): `` is a `` in a ``. For example, user **user@domain.com** is a **department admin** in **department A**. ## Access Rules Table The Access rules table can be found under **Access** in the NVIDIA Run:ai platform. The Access rules table provides a list of all the access rules defined in the platform and allows you to manage them. **Flexible management** It is also possible to manage access rules directly for a specific [user](/run-ai/self-hosted/documentation/platform-management/authentication/users), [service account](/run-ai/self-hosted/documentation/platform-management/authentication/service-accounts), [project](/run-ai/self-hosted/documentation/platform-management/manage-ai-initiatives/organization/projects), or [department](/run-ai/self-hosted/documentation/platform-management/manage-ai-initiatives/organization/departments).
The Access rules table consists of the following columns: | Column | Description | | ------------- | ------------------------------------------------------------------------------------------------------------ | | Type | The type of subject assigned to the access rule (User, SSO Group, Service account, or All authenticated users and service accounts). | | Subject | The User, SSO Group, or Service account assigned with the role. Not applicable when Type is All authenticated users and service accounts. | | Role | The role assigned to the subject | | Scope | The scope to which the subject has access. Click the name of the scope to see the scope and its subordinates | | Status | The access rule creation status. | | Authorized by | The user who granted the access rule | | Creation time | The timestamp for when the rule was created | | Last updated | The last time the access rule was updated | ### Access Rule Status The following table describes the condition of access rules and whether they were successfully created for the selected scope. The status indicates whether the access rule is synced in the cluster. | Status | Description | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | No issues found | No issues were found while creating the access rule | | Issues found | Issues were found while enforcing the access rule in the cluster(s). | | Creating… | The access rule is being created in the cluster | | No status | Status cannot be displayed because the current version of the cluster is not up to date or unknown | ### Customizing the Table View * Filter - Click ADD FILTER, select the column to filter by, and enter the filter values * Search - Click SEARCH and type the value to search by * Sort - Click each column header to sort by * Column selection - Click COLUMNS and select the columns to display in the table * Download table - Click MORE and then Click Download as CSV. Export to CSV is limited to 20,000 rows. ## Adding New Access Rules To add a new access rule: 1. Click **+NEW ACCESS RULE** 2. Select a subject - **User, SSO Group, Service account**, or **All authenticated users and service accounts** 3. Select or enter the subject identifier. You can define up to 10 subjects of the selected type. Not applicable when the subject is All authenticated users and service accounts: * **User** for a local user created in NVIDIA Run:ai or for an SSO user as recognized by the IDP. Search by name or email, or manually enter the user's email if they do not appear in the search results. * **Group name** as recognized by the IDP * **Service account name** as created in NVIDIA Run:ai 4. Select a **role** 5. Select up to 10 **scopes** where the access rule will apply 6. Click **SAVE RULE** ## Editing an Access Rule Access rules cannot be edited. To change an access rule, you must delete the rule, and then create a new rule to replace it. ## Deleting an Access Rule 1. Select one or more access rules you want to delete 2. Click **DELETE** 3. On the dialog, click **DELETE** to confirm ## Transitioning Access Rules to New Roles Due to the deprecation of some roles, referred to as [legacy roles](/run-ai/self-hosted/documentation/platform-management/authentication/roles#roles-in-nvidia-run-ai), access rules using them should be transitioned to supported roles. When access rules still use legacy roles, a banner at the top of the Access rules table prompts you to transition them. Transitioning recreates each selected rule under a new role with the same subject and scope, and deletes the legacy rule. To transition access rules: 1. On the banner, click **transition to new roles** 2. In the **Transition Access Rules To New Roles** dialog, select the access rules to transition 3. For each legacy role listed, select a **new role**. For some legacy roles, NVIDIA Run:ai pre-selects a recommended replacement, which you can change. 4. Click **TRANSITION ACCESS RULES** to confirm **Required permissions** Your role must include the **Create**, **Read**, **Update**, and **Delete** permissions on the **Access rules** resource. ## Viewing Your User Access Rule To view the assigned roles and scopes you have access to: 1. Click the user avatar at the top right corner, then select **Settings** 2. Click **User details** The list of assigned roles and scopes will be displayed. ## Using API Go to the [Access rules](https://docs.nvidia.com/run-ai/multi-tenant/v3.0/reference/rest-api/endpoints/authentication-and-authorization/access-rules/get-access-rules) API reference to view the available actions.