> ## Documentation Index
> Fetch the complete documentation index at: https://docs.braintrust.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Online scoring service accounts in project ACLs

> [!NOTE]
>
> **Applies to:**
>
> * Plan - Any
> * Deployment - Any
> *
> * Use case - Auditing project access and encountering unknown user IDs or ForbiddenErrors when resolving the bt:async\_scoring online scoring service account

## Summary

**Goal:** Understand and identify auto-created online scoring service accounts during project access audits.

**Features:** ACL endpoint, bt:async\_scoring role, service account user type, ForbiddenError handling.

## What is the bt:async\_scoring service account

Each project that uses online scoring automatically gets a dedicated service account. This account has `user_type: service_account` and is a real user record in Braintrust, but it is not a human user and has no login.

The service account is granted the `bt:async_scoring` role on the project via an ACL row. This role allows Braintrust to mint short-lived credentials for running online scoring.

* **Role name:** `bt:async_scoring`
* **Role ID:** `d25ef5a8-...`
* **Purpose:** Service role for async/online scoring

## Identifying service accounts in an access audit

### Step 1: List all ACLs for a project

```
GET /v1/acl?object_type=project&object_id=<PROJECT_ID>
```

Look for rows where `role_id = d25ef5a8-...`. The `user_id` on that row is the auto-created service account for that project.

### Step 2: Confirm the role

```
GET /v1/role/d25ef5a8-c1e0-4834-a1c7-b82ce7d4b82a
```

This returns the `bt:async_scoring` role definition.

## ForbiddenError on user resolution

Owners and admins will see a `ForbiddenError` when attempting to resolve a service account user ID via the `/user` endpoint:

```
ForbiddenError: Missing read access to user id <user_id>, or the user does not exist
```

This is expected. Service account users are not resolvable by human users, including Owners.

## Membership in the All AI Provider Access group

Braintrust adds the service accounts it provisions automatically, including online scoring service accounts, to the **All AI Provider Access** built-in permission group at creation. This group grants read access to organization AI providers, which the service account needs in order to run online scoring.

If you audit ** Settings** > [** Permissions**](https://www.braintrust.dev/app/~/configuration/permissions/organization) and see an online scoring service account listed under **All AI Provider Access**, this is expected and not a sign of unauthorized access. Removing it can stop online scoring from calling your AI providers.

See [Organization AI providers](https://docs.braintrust.dev/admin/ai-providers.md#organization-ai-providers) for what the group covers.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.