Skip to main content

​
Organizations

Prism is multi-tenant. An API key resolves to one user and can carry one organization ID. Facade currently applies the key’s organization model, rate, budget, and balance policy before sending a request to a model provider.

​
Policy layers

Request admission evaluates:
  1. API-key authentication
  2. owner credit and trial state
  3. rate limit
  4. trial scope and model policy
  5. available balance
  6. organization budget
  7. API-key scope, model allowlist, and organization model override
  8. credit reservation
This order means a valid key can still receive 402, 403, or 429 as policy, balance, and organization state change.

​
Keys and people

Use a distinct key for each service or employee integration. This gives administrators a narrow revocation boundary and preserves useful attribution. Do not share one secret across an entire organization. When a person leaves, revoke their credential immediately. Current self-service offboarding does not automatically invalidate an existing key. Never give the same raw secret to a replacement.
Self-service offboarding does not revoke a credential automatically. Revoke the departing person’s key before removing access elsewhere, and create a new secret for any replacement.
อ่านภาษาไทย