Model access for users and groups

Renta keeps an access list for every data model that AI agents can query. The list names the workspace members and groups that can describe and query the model through AI agents and the Renta API.

A new model is closed by default. Only its creator and the workspace owners can use it until an owner adds other people.

Before you begin

Check the following before you change an access list.

1. Owner role.
   Only workspace owners change access lists. Members can view them. To check roles, see Team & Roles.
2. Model scope.
   A model has an access list when its scope is AI agents only or AI agents & Reverse ETL. A model with the Reverse ETL only scope is not available to AI agents, so it has no list to manage.
3. Members and groups.
   You can add only members who have joined the workspace. To grant a model to several people at once, create a group first.

Who can use a model

Renta checks workspace membership and the access list on every request to a model. The following table shows how each kind of access works.

Grant access from the model list

You need the owner role in the workspace.

Open the access panelStep 1

1. In the left sidebar, click Context layers.
2. Find the model and click its cell in the Access column. You can also open the row menu and select Access.

The Access column shows who can use each model: the avatars of listed users and groups, or Owners only when nobody else is listed. A dash means the model has the Reverse ETL only scope.

Select users and groupsStep 2

The Access panel opens with the model name in the header.

1. In the Users card, select the members who need direct access.
2. In the Groups card, select the groups. Every member of a selected group can use the model.
3. Click Save.

Selected users and groups appear below each picker. To remove one before you save, click the cross next to it.

Manage access on the model page

The Access tab of a model shows the same list with more detail. Use it to review who has access and why.

1. In the left sidebar, click Context layers and open the model.
2. Open the Access tab (1).
3. In the Users card, click Add users (2), select the members, and then click Add users in the panel.
4. In the Groups card, click Add groups (3), select the groups, and then click Add groups in the panel.
5. Click Save changes (4).

Changes on this tab apply only after you click Save changes.

The Add groups panel lists the groups that are not on the model yet. Select a group (1) and click Add groups (2). The Add users panel works the same way.

The Access column of the Users card shows why each person can use the model.

Members who have access only through a group are not listed in the Users card. To see them, click the group in the Groups card and check its member count, or open the group on the Team members page.

Remove access

Remove a user or a group on the Access tab of the model.

1. Click the row of the user or the group. The User access or Group access panel opens.
2. Click Remove access.
3. Click Save changes.

A removed user stays in the workspace and no longer sees or queries the model. Members of a removed group lose access unless they are also listed in the Users card.

You cannot remove your own access or the access of another owner.

Set access when you create a model

When the scope of a new model includes AI agents, the model wizard adds the Access step after Measures. Your account is already selected as the creator.

1. Owners.
   Add users and groups on this step, the same way as on the Access tab.
2. Members.
   A member creates the model with access for themselves only. An owner can add other people later.

What happens when the team changes

Renta updates access when the workspace team changes. You do not need to edit the lists by hand.

Access lists in the REST API and MCP

The data model API returns and accepts the same list in the model_access field. Requests need a Renta API token with permissions in the Context Layer category.

The list is replaced as a whole. Send every user and group that keeps access, not only the new ones.

Terminal

curl -X PATCH "https://api.eu.renta.im/v1/data_model" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "model_id": "MODEL_ID",
    "model_access": {
      "user_ids": ["USER_ID"],
      "group_ids": ["GROUP_ID"]
    }
  }'

In the Renta MCP Server, the manage_data_models tool accepts the same model_access object when it creates a model.

Related pages

The following pages describe groups, roles, and the models that the access list protects.