Service token permissions for log ingestion

​

Summary

Overview: Service tokens for log ingestion require specific permission combinations to write logs successfully to Braintrust projects. Key insight: Log writes use merge/update operations internally, requiring update permissions even for new log creation.

​

How log ingestion permissions work

​

Required permissions

​

Why Logs Create alone fails

Logs Create permission is insufficient because:

• All log writes use a merge/update operation internally
• The system does not distinguish between inserting new logs and updating existing ones
• Even “new” log entries follow the update code path

​

Permission scoping

Service tokens support fine-grained scoping. For least privilege, grant update on Project Log (and read on Project only if the token must also fetch logs). Granting update directly on the Project also enables ingestion via inheritance, but it cascades to experiments, datasets, prompts, etc., so prefer the narrower scope. Avoid Project Delete or Manage ACLs unless explicitly needed.