Anthropic Enterprise RBAC
Overview
Anthropic provides organization-level access control through Workspaces, API key scoping, and member roles via the Console at console.anthropic.com.
Organization Structure
Organization (billing entity)
├── Workspace: Production
│ ├── API Key: sk-ant-api03-prod-main-...
│ ├── API Key: sk-ant-api03-prod-batch-...
│ └── Rate limits: Tier 4
├── Workspace: Staging
│ ├── API Key: sk-ant-api03-stg-...
│ └── Rate limits: Tier 2
└── Workspace: Development
├── API Key: sk-ant-api03-dev-...
└── Rate limits: Tier 1
Console Roles
| Role |
Capabilities |
| Owner |
Full access, billing, member management |
| Admin |
Manage workspaces, API keys, view usage |
| Developer |
Create/revoke own API keys, view own usage |
| Billing |
View invoices and usage reports only |
Application-Level RBAC
# Implement your own RBAC on top of Anthropic Workspaces
from enum import Enum
import anthropic
class UserRole(Enum):
VIEWER = "viewer" # Can read Claude responses (no direct API)
USER = "user" # Can send prompts (rate limited)
POWER_USER = "power" # Can use Opus, higher limits
ADMIN = "admin" # Can access all models, no limits
ROLE_CONFIG = {
UserRole.VIEWER: {"allowed": False},
UserRole.USER: {
"allowed": True,
"models": ["claude-haiku-4-20250514"],
"max_tokens": 512,
"rpm_limit": 10,
},
UserRole.POWER_USER: {
"allowed": True,
"models": ["claude-haiku-4-20250514", "claude-sonnet-4-20250514", "claude-opus-4-20250514"],
"max_tokens": 4096,
"rpm_limit": 60,
},
UserRole.ADMIN: {
"allowed": True,
"models": ["claude-haiku-4-20250514", "claude-sonnet-4-20250514", "claude-opus-4-20250514"],
"max_tokens": 8192,
"rpm_limit": 200,
},
}
def create_message(user_role: UserRole, model: str, **kwargs):
config = ROLE_CONFIG[user_role]
if not config["allowed"]:
raise PermissionError("Role does not allow API access")
if model not in config["models"]:
raise PermissionError(f"Role cannot access model: {model}")
kwargs["max_tokens"] = min(kwargs.get("max_tokens", 1024), config["max_tokens"])
client = anthropic.Anthropic()
return client.messages.create(model=model, **kwargs)
Key Management Best Practices
| Practice |
Implementation |
| One key per service |
prod-auth-service, prod-search-service |
| Rotate quarterly |
Calendar reminder + automated rotation |
| Least privilege |
Dev workspace for dev keys only |
| Audit trail |
Log which key made each request |
| Revoke immediately |
On employee departure or compromise |
Error Handling
| Issue |
Cause |
Fix |
| Key works in dev, fails in prod |
Wrong workspace key |
Verify key belongs to prod workspace |
| New team member can't access |
Not added to workspace |
Invite via Console > Members |
| Usage not visible |
Viewing wrong workspace |
Switch workspace in Console |
Resources
Next Steps
For major migration strategies, see anth-migration-deep-dive.
Source: jeremylongshore/claude-code-plugins-plus-skills → plugins/saas-packs/anthropic-pack/skills/anth-enterprise-rbac/SKILL.md
1---2name: anth-enterprise-rbac3description: 'Configure Anthropic enterprise organization management, Workspaces, and role-based access control for teams. Trigger with phrases like "anthropic enterprise", "claude rbac", "anthropic workspaces", "claude team access", "anthropic organization". '4---56# Anthropic Enterprise RBAC78## Overview910Anthropic provides organization-level access control through Workspaces, API key scoping, and member roles via the Console at [console.anthropic.com](https://console.anthropic.com).1112## Organization Structure1314```15Organization (billing entity)16├── Workspace: Production17│ ├── API Key: sk-ant-api03-prod-main-...18│ ├── API Key: sk-ant-api03-prod-batch-...19│ └── Rate limits: Tier 420├── Workspace: Staging21│ ├── API Key: sk-ant-api03-stg-...22│ └── Rate limits: Tier 223└── Workspace: Development24 ├── API Key: sk-ant-api03-dev-...25 └── Rate limits: Tier 126```2728## Console Roles2930| Role | Capabilities |31|------|-------------|32| Owner | Full access, billing, member management |33| Admin | Manage workspaces, API keys, view usage |34| Developer | Create/revoke own API keys, view own usage |35| Billing | View invoices and usage reports only |3637## Application-Level RBAC3839```python40# Implement your own RBAC on top of Anthropic Workspaces41from enum import Enum42import anthropic4344class UserRole(Enum):45 VIEWER = "viewer" # Can read Claude responses (no direct API)46 USER = "user" # Can send prompts (rate limited)47 POWER_USER = "power" # Can use Opus, higher limits48 ADMIN = "admin" # Can access all models, no limits4950ROLE_CONFIG = {51 UserRole.VIEWER: {"allowed": False},52 UserRole.USER: {53 "allowed": True,54 "models": ["claude-haiku-4-20250514"],55 "max_tokens": 512,56 "rpm_limit": 10,57 },58 UserRole.POWER_USER: {59 "allowed": True,60 "models": ["claude-haiku-4-20250514", "claude-sonnet-4-20250514", "claude-opus-4-20250514"],61 "max_tokens": 4096,62 "rpm_limit": 60,63 },64 UserRole.ADMIN: {65 "allowed": True,66 "models": ["claude-haiku-4-20250514", "claude-sonnet-4-20250514", "claude-opus-4-20250514"],67 "max_tokens": 8192,68 "rpm_limit": 200,69 },70}7172def create_message(user_role: UserRole, model: str, **kwargs):73 config = ROLE_CONFIG[user_role]74 if not config["allowed"]:75 raise PermissionError("Role does not allow API access")76 if model not in config["models"]:77 raise PermissionError(f"Role cannot access model: {model}")78 kwargs["max_tokens"] = min(kwargs.get("max_tokens", 1024), config["max_tokens"])7980 client = anthropic.Anthropic()81 return client.messages.create(model=model, **kwargs)82```8384## Key Management Best Practices8586| Practice | Implementation |87|----------|---------------|88| One key per service | `prod-auth-service`, `prod-search-service` |89| Rotate quarterly | Calendar reminder + automated rotation |90| Least privilege | Dev workspace for dev keys only |91| Audit trail | Log which key made each request |92| Revoke immediately | On employee departure or compromise |9394## Error Handling9596| Issue | Cause | Fix |97|-------|-------|-----|98| Key works in dev, fails in prod | Wrong workspace key | Verify key belongs to prod workspace |99| New team member can't access | Not added to workspace | Invite via Console > Members |100| Usage not visible | Viewing wrong workspace | Switch workspace in Console |101102## Resources103104- [Console](https://console.anthropic.com)105- [Workspaces](https://docs.anthropic.com/en/docs/administration/workspaces)106107## Next Steps108109For major migration strategies, see `anth-migration-deep-dive`.110111---112113**Source:** [`jeremylongshore/claude-code-plugins-plus-skills`](https://github.com/jeremylongshore/claude-code-plugins-plus-skills) → `plugins/saas-packs/anthropic-pack/skills/anth-enterprise-rbac/SKILL.md`
thedixitjain