LangSmith Launches Role-Based Access Control

LangChain has rolled out new access management features for LangSmith, its LLM application engineering platform. The update introduces Role Based Access Control (RBAC) to help large development teams manage permissions systematically. Currently available to customers on the Enterprise tier, RBAC allows administrators to assign specific roles to users within their organization or workspace. By default, the system includes three built-in roles: Admin, which has full access; Viewer, which provides read-only access; and Editor, which grants full permissions except for workspace management tasks like adding users or configuring service keys.

To further isolate resources, LangSmith now supports workspaces, which group users and assets to prevent unauthorized access across different projects. Administrators can also design custom roles with granular permissions tailored to specific job functions. This minimizes security risks by ensuring team members only have access to the exact tools and data required for their tasks.

Alongside RBAC, LangChain has overhauled its API key system by introducing Personal Access Tokens (PATs) and Service Keys. PATs are tied directly to individual users, sharing their exact permission levels, and are automatically deleted if the creator leaves the organization. Service Keys act as service principals with administrative privileges, designed for automated systems interacting with the LangSmith API. These keys remain unaffected by organizational staff changes and can only be generated by workspace admins.

Practitioners should note that legacy "ls__" API keys have already been migrated to service keys. However, LangChain plans to completely retire support for these older keys on July 1, 2024, requiring developers to transition to the new token system to avoid service interruptions.