> ## Documentation Index
> Fetch the complete documentation index at: https://docs.braintrust.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# No export-only permission in Braintrust ACL model

> [!NOTE]
>
> **Applies to:**
>
> * Plan - Plans: Enterprise
> * Deployment - Deployments: Any
> *
> * Use case - Enterprise customers wanting to allow users to view data in the UI but prevent them from bulk exporting or downloading data

## Summary

**Goal:** Understand why there is no export-specific permission in Braintrust and how to limit data access.

**Features:** ACL permissions (`create`, `read`, `update`, `delete`, ACL management), project-scoped roles, API key controls.

***

## No export-specific permission exists

Braintrust's permission model does not have a dedicated export or download permission. The available permissions are:

* `create`, `read`, `update`, `delete`
* `create_acls`, `read_acls`, `update_acls`, `delete_acls`

`read` controls all data access. In the UI, download and export controls are hidden for users who have `read` but not `update` or `delete`. Programmatic export via the API and SDK is still available to any user with `read`, so read cannot be fully separated from export.

There is no configuration that fully prevents a user with `read` from exporting: even when the UI controls are hidden, that user can still export the same data through the API or SDK if issued an API key.

***

## Limiting data access

Since export cannot be separated from read, the only way to restrict exports is to restrict `read` access itself.

**Restrict by project or object**

Assign users to custom permission groups scoped to specific projects or objects. This limits which data they can read — and therefore export.

The Viewer role grants read access across the organization and only restricts `create`, `update`, and `delete`. Viewers do not see UI download or export controls, but they retain programmatic export access through the API and SDK.

**Restrict API-based bulk exports**

No permission prevents a user with `read` access from making bulk API calls. To limit this:

* Control which users are issued API keys.
* Scope service account permissions to specific objects rather than the entire org.

**Cloud storage automations**

Cloud storage export automations are an org-level admin feature and cannot be used to restrict user-initiated exports. See [Export to cloud storage](https://docs.braintrust.dev/admin/data-management/export.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.