Enterprise Authentication and Authorization

3/19/2026

This post introduces and details the implementation of enterprise-grade security features in Weaviate, focusing on securing AI applications in regulated environments. It covers OIDC integration for delegated authentication, eliminating the need to store user credentials and reducing the attack surface. The post elaborates on RBAC for fine-grained access control, demonstrating how to define roles and permissions for different collections and users. It also explains how OIDC groups can be leveraged to dynamically manage role assignments, ensuring that access rights stay synchronized with organizational changes. Furthermore, the post details multi-tenant security for data isolation within shared collections and highlights the importance of audit logging for compliance purposes, providing concrete examples of how these features address auditor questions and ensure data security and privacy.

2/18/2026

This post expands on enterprise authentication and authorization by detailing the practical implementation of API key authentication with programmatic user management, including creating, rotating, and assigning roles to users. It also elaborates on the RBAC system, explaining permissions, roles, and the use of built-in roles like 'admin' and 'viewer', as well as the concept of custom roles for fine-grained access control. The importance of audit logging for security monitoring, incident response, and compliance is further emphasized.