Oracle Cloud Infrastructure Documentation

API-Level Permissions for Custom Models

This page provides access and authorization information for the OCI Generative AI custom model resource type.

Note

The generative-ai-model resource type applies only to custom models. In the Console, custom models are foundational models that have been fine-tuned using Generative AI. This resource type doesn't apply to the base foundational models.

For specific permissions for this resource type, review this page. For a list of all resource types available in OCI Generative AI, see User Access to Individual Resources.

Resource Type

Resource Type for IAM Permissions Documentation Reference API Reference
generative-ai-model Managing Custom Models Model

Inspect Permission

Grant user groups inspect permission to run the following operations:

  • GET ListModels

Read Permission

Grant user groups read permission to run the following operations:

  • GET ListModels
  • GET GetModel

Use Permission

Grant user groups use permission to run the following operations:

  • GET ListModels
  • GET GetModel
  • PUT UpdateModel

Manage Permission

Grant user groups manage permission to run the following operations:

  • GET ListModels
  • GET GetModel
  • PUT UpdateModel
  • POST ChangeModelCompartment
  • POST CreateModel
  • DELETE DeleteModel
Note

  • The manage permission includes all actions allowed by use, read, and inspect.
  • The use permission includes all actions allowed by read and inspect.
  • The read permission includes all actions allowed by inspect.
Tip

The generative-ai-model resource type is part of generative-ai-family. If you have permission to the family, you have the same permission for this resource type. For example: 
allow group <your-group-name> to manage generative-ai-family
in compartment <your-compartment-name>

1-1 Permissions for APIs

Note

We recommend using the higher-level IAM verbs, manage, use, read, and inspect, for a better user experience. For example, you might grant a user group permission to delete a resource, but if you don't also grant permission to list that resource, users might not find it.

If a use case requires access to only a specific API operation, you can use the individual permissions listed here.

generative-ai-model

Permission API Operation Operation Type Verb
GENERATIVE_AI_MODEL_INSPECT ListModels GET inspect
GENERATIVE_AI_MODEL_READ GetModel GET read
GENERATIVE_AI_MODEL_UPDATE UpdateModel PUT use
GENERATIVE_AI_MODEL_MOVE ChangeModelCompartment POST manage
GENERATIVE_AI_MODEL_CREATE CreateModel POST manage
GENERATIVE_AI_MODEL_DELETE DeleteModel DELETE manage

For example, the following two policies are equivalent:

allow group <your-user-group> to manage generative-ai-model
in compartment <your-compartment-name>
allow group <your-user-group> to
{GENERATIVE_AI_MODEL_INSPECT, GENERATIVE_AI_MODEL_READ, GENERATIVE_AI_MODEL_UPDATE, GENERATIVE_AI_MODEL_MOVE, GENERATIVE_AI_MODEL_CREATE, GENERATIVE_AI_MODEL_DELETE}
in compartment <your-compartment-name>