Role-based access control (RBAC) authorizes enterprise AI systems by assigning permissions to roles and granting users or services access through those roles. For Azure OpenAI, RBAC can enable API calls without distributing keys, while limiting access to model repositories, training environments, and connected resources. section 13.2.7 section 11.5.2
A production-oriented RBAC design combines several controls:
- Assign only the roles required for a user or managed identity, applying the principle of least privilege. section 13.2.7
- Use managed identities and Azure Active Directory (Entra ID) to authenticate services without storing secrets, certificates, or keys in application code. section 11.5.2
- Audit access logs and activities involving model repositories, and restrict the network resources, internal services, and APIs available to the application. section 13.2.7
Azure OpenAI with a managed identity
An Azure-hosted application can use a system- or user-assigned managed identity, grant it an appropriate Azure role such as user or contributor, and authenticate through DefaultAzureCredential rather than an API key. The Python client obtains a bearer token through the configured identity provider. section 11.5.2
