Roles & Permissions Matrix
Applies to: Organization (top-level user), Subuser Updated: 2026-07-02
This article uses comparison tables to make clear what each role in the new console can and cannot do, helping you judge "should this be done by the organization, by the subuser, or does it require contacting CloudRouter."
For the conceptual background of the three-tier hierarchy, see Three-Tier Account Hierarchy.
1. Role Definitions
| Role | One-line positioning |
|---|---|
| Organization (top-level user) | Enterprise account; manages the organization's balance, subusers, Keys, and usage |
| Subuser | Caller; manages their own Keys and usage |
Platform-level configuration (model listing, pricing, organization activation, etc.) is handled centrally by CloudRouter official operations and is not a role within the console.
2. Full Permissions Comparison
✅ Allowed ｜ ❌ Not permitted ｜ 🔸 Limited to own organization/self ｜ ⚠️ Planned / not yet supported
Account & Organization
| Capability | Organization | Subuser |
|---|---|---|
| Create/edit/deactivate subusers | ✅ 🔸 | ❌ |
| Set subuser business identity (account name/email/notes) | ✅ 🔸 | ❌ |
| Edit own profile | ✅ | ✅ 🔸 |
Activation and deactivation of organization accounts are handled by the platform. Contact CloudRouter if needed.
Funds & Quota
| Capability | Organization | Subuser |
|---|---|---|
| Online top-up / redemption-code top-up | ✅ 🔸 | ❌ |
| Set quota limits for subusers | ✅ 🔸 | ❌ |
| Refund | ❌ (contact official) | ❌ |
| Download payment receipts / request invoices | ✅ 🔸 | ❌ |
| View organization balance transactions | ✅ 🔸 | ❌ |
| View own usage | ✅ | ✅ 🔸 |
Keys & Calls
| Capability | Organization | Subuser |
|---|---|---|
| Create API Keys | ✅ | ✅ 🔸 |
| Configure a Key's routing group and advanced allowlist | ✅ 🔸 | 🔸 (own Keys, routing group only) |
| Set a Key's IP blocklist/allowlist | ✅ 🔸 | 🔸 (own Keys) |
| View the "Call Guide" (including model call names and fingerprint identifiers) | ✅ | ✅ 🔸 |
| Call models | ✅ | ✅ 🔸 |
Platform Configuration
The following items are configured centrally by the platform. Neither organizations nor subusers can operate them within the console. To adjust them, contact CloudRouter:
- Organization-level concurrency limit
- Organization's available model scope
- Model listing / model pricing adjustments
3. Key Boundaries: What Requires Contacting CloudRouter
As an organization, the following operations are beyond your ability to complete on your own and require contacting CloudRouter:
| Item | Why | What to do |
|---|---|---|
| Raise the organization concurrency limit | Involves platform resource allocation | Contact CloudRouter to adjust the quota, see Concurrency Settings |
| Adjust the available model scope | Platform-level resource control | Configured centrally by the platform; to adjust, contact CloudRouter, see Region & Model Scope |
| Refund | Involves fund security | Contact CloudRouter and provide the order number |
| List a new model / adjust model pricing | Platform operational decision | Watch for system announcements |
4. The Organization's "Dual Identity"
An organization (top-level user) is both a "manager" and a "caller": it can both manage subusers and set quotas, and also create its own Keys to call models. Note two things:
- Quotas are for subusers: Quota limits are set for subusers; the organization's own spending goes directly against the organization balance
- Cannot deactivate/delete itself: To change the account entity, contact CloudRouter
5. About Managing Subusers' Keys
- Subusers self-serve create Keys: On the "API Keys" page, a subuser can self-serve create multiple Keys, each independently named and bound to one routing group (selectable only within the organization's authorized scope), subject to the quota limit; the organization can also create and distribute them on their behalf. See Subuser Management.
- How to restrict a subuser: You can restrict their calls by deactivating the subuser account or by lowering/exhausting their quota limit (when the quota is exhausted, all Keys under them are rejected together).
6. v1 → v2 Role Naming Comparison
| Legacy name | New name | Capability change |
|---|---|---|
| System admin | Platform (CloudRouter official operations) | Platform-level configuration handled centrally by official operations |
| Tenant / tenant admin | Organization (top-level user) | Largely inherited, with new subuser business identity, Key routing group, and advanced allowlist |
| Regular member | Subuser | Menu narrowed to 5 items; can self-serve create Keys (limited to authorized groups) |
Contact Us
- Email: support_cloudrouter@clouditera.com
- QQ community: 712273971
- Platform URL: cloudrouter.online