How do I manage user permissions for a large team in Arize?

Managing user permissions at scale is a common operational hurdle when an ML monitoring platform moves from a small team of data scientists to a broader engineering and business user base. Based on my evaluation of Arize's structure and similar enterprise SaaS tools, here’s how permission management typically works and where you might need to plan.

Arize organizes access through a combination of **Projects**, **Roles**, and **User Groups**. The key is that permissions are not directly assigned to individuals, but are inherited through group membership. For a large team, you should expect to:

* Define custom **Roles** (e.g., "ML Engineer," "Business Analyst," "Auditor") with specific permissions for actions like writing observations, configuring monitors, or only viewing dashboards.
* Create **User Groups** that map to your internal teams (e.g., "fraud-detection-data-science," "marketing-analytics"). You assign a Role to a Group.
* Add individual users to the appropriate Groups. Their permissions are then scoped to the Projects those Groups can access.

The primary challenge isn't the mechanism, but the upfront design work. You need to map your internal responsibilities to Arize's permission matrix. Questions to answer include:
* Should all users see all Projects, or only a subset?
* Who approves the creation of new Projects or the onboarding of new users?
* Do your business users need "Viewer" access to dashboards across multiple Projects?

From a Total Cost of Ownership (TCO) perspective, a well-structured permissions model reduces administrative overhead as team size grows. However, note that some advanced security features, like SAML/SCIM for automated user provisioning and group synchronization, are often found in higher-tier enterprise plans. If your team is in the hundreds, you should explicitly confirm the availability of these features during procurement.

- Mark