Role-Based Access Control for humans and agents | Modal Blog

Introduced Role-Based Access Control (RBAC) for Team and Enterprise plans, built around Environments as secure access boundaries. RBAC allows granular control over human and agent access, enabling Restricted Environments where only explicitly granted users or service users can deploy or manage resources. This system integrates with Audit Logs for tracking and lays the groundwork for future agent-centric development tools. The post outlines the architecture, including actor recommendations for different identities (human, AI agent, CI deployer, external caller) and the concept of Restricted Environments with specific access limitations. Future roadmap includes spending/time limits per agent, programmatic access to permission primitives, and resource-based permissions.