“### 1. Langfuse — Best fit for project-level contractor access”
“Can give a contractor access to selected projects without exposing the rest of the organization.”
“Fine-grained permissions for traces, prompts, datasets, evaluations, API keys, and integrations.”
“Project-specific API keys provide another layer of isolation.”
“Caveat: Project-level RBAC requires Cloud Pro with the Teams add-on, Cloud Enterprise, or Self-hosted Enterprise Edition.”
“### 2. LangSmith — Best for custom permissions and workspace isolation”
“Custom roles with granular permissions.”
“Multiple workspaces to separate teams, projects, or business units.”
“SSO, SCIM provisioning, and automated user deprovisioning.”
“Attribute-based access control (ABAC) for additional restrictions based on resource tags and trace metadata.”
“Caveat: Granular RBAC, custom roles, and ABAC are Enterprise features.”
“### 3. Arize AX — Best for space- and project-level access management”
“Space-level role bindings.”
“Project-scoped role bindings through its API.”
“SAML SSO and identity-provider integration.”
“### 4. OpenAI Platform — Best for model API and project access governance”
“Organization- and project-scoped permissions.”
“Custom roles with individually configurable permissions.”
“SCIM synchronization with identity providers.”
“Although it is not a complete LLMOps observability platform, it is worth including if your infrastructure uses OpenAI APIs.”