Skip to content

Registry: Add info about SA access to different types of registries #2753

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ngrayluna wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Registry: Add info about SA access to different types of registries #2753

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e45d238
Add info about SA access to different types of registries
ngrayluna Jun 11, 2026
d6ce8fb
word smith
ngrayluna Jun 11, 2026
35891a8
more word smithing
ngrayluna Jun 11, 2026
9220ea9
feedback
ngrayluna Jun 12, 2026
2d500b1
Merge branch 'main' into sa_registry_access
ngrayluna Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions models/registry/configure_registry.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ Registry admins can add individual users or entire teams to a registry. To add a
<img src="/images/registry/add_team_registry.gif" alt="Adding teams to registry" />
</Frame>

Learn more about [configuring user roles in a registry](/models/registry/configure_registry/#configure-registry-roles), or [registry role permissions](/models/registry/configure_registry/#registry-role-permissions) .
Learn more about [configuring user roles in a registry](/models/registry/configure_registry/#configure-registry-roles), or [registry role permissions](/models/registry/configure_registry#role-permissions) .

### Remove a user or team
A registry admin can remove individual users or entire teams from a registry. To remove a user or team from a registry:
Expand Down Expand Up @@ -80,11 +80,28 @@ W&B automatically assigns a default **registry role** to a user or team when the
| Service account (non admin) | Member<sup><a href="#service_account_footnote">1</a></sup> | Member<sup><a href="#service_account_footnote">1</a></sup> |
| Org admin | Admin | Admin |

<a id="service_account_footnote">1</a>: Service accounts cannot have **Viewer** or **Restricted Viewer** roles.
<a id="service_account_footnote">1</a>: Service accounts cannot have **Viewer** or **Restricted Viewer** roles. See [Service account access](#service-account-access) for how a service account's access is determined.

A registry admin can assign or modify roles for users and teams in the registry.
See [Configure user roles in a registry](/models/registry/configure_registry/#configure-registry-roles) for more information.

### Service account access

W&B assigns a default access level to a service account based on the registry's visibility and the service account's team role. A registry admin can modify a service account's access by [adding the service account to the registry with a Member or Admin role](/models/registry/configure_registry/#add-a-user-or-a-team-to-a-registry).

The following describes the default access level for a service account:

- **Registries with Organization visibility**: a service account automatically has **Member** access.
Comment thread
ngrayluna marked this conversation as resolved.
- **Registries with Restricted visibility**: service acount access depends on the role assigned to the service account's team:
Comment thread
ngrayluna marked this conversation as resolved.

@ibindlish ibindlish Jun 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- **Registries with Restricted visibility**: service acount access depends on the role assigned to the service account's team:
- **Registries with Restricted visibility**: service acount access depends on the role assigned to the service account's team or the service account itself:

@ibindlish ibindlish Jun 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this still reads to me as though one needs to assign a team role for the service account to receive a role in a restricted registry. i think we should instead focus on how service accounts dont inherit higher permissions just because a team they're in gets assigned "admin" in a registry. (and this is true for both restricted and non-restricted registries)

- If the team is added to the registry as a **Member** or **Admin**, the service account automatically receives **Member** access.
Comment thread
ngrayluna marked this conversation as resolved.
- If the team is a **Viewer** or **Restricted Viewer**, the service account does *not* receive access automatically.

<Note>
Service accounts cannot have **Viewer** or **Restricted Viewer** roles.
</Note>

See [Visibility types](/models/registry/create_registry#visibility-types) for more information about registry visibility types.

### Role permissions
The following table lists each Registry role, along with the permissions provided by each role:

Expand Down
Loading