AI Provider Admin Controls

Workbench | Preview

WarningPreview feature

This feature is in preview. Preview features are unsupported and may face breaking changes in a future release. Any issues found in the feature will be addressed during the regular release schedule; they will not result in immediate patches or hotfixes.

We encourage customers to try these features and we welcome any feedback via Posit Support, but we recommend that the feature not be used in production until it is in general availability (i.e., officially released as a full feature). To provide feedback, please email your Posit Customer Success representative or and specify that you are trialing this feature.

You can define the ai-providers-enforced setting in /etc/rstudio/profiles to supply a base AI-provider configuration for your users. Posit Workbench resolves the setting per user at session launch and applies the configuration to Positron Pro sessions, constraining the AI providers and models available to Posit Assistant. Like other profile settings, it is scoped with a global section ([*]), per-group sections ([@groupname]), and per-user sections ([username]), where the more specific scope wins. See User and Group Profiles for the full profiles syntax.

Note

ai-providers-enforced applies to Positron Pro sessions only. The RStudio Pro IDE does not enforce this configuration.

ai-providers-enforced

Property Value
Type path to a JSON file (in the providers.json schema)
Default unset (no enforced configuration)

Path to a JSON file that supplies the AI-provider configuration. Workbench resolves this setting per user at session launch and forwards the file’s contents to Positron Pro sessions as a providers.json-schema configuration. Use this setting to constrain which AI providers and models are available. You can also supply provider connection settings, configure provider discovery, and define custom providers.

Path resolution for ai-providers-enforced mirrors positron-enforced-settings. A relative path resolves against the directory that contains the profiles file (/etc/rstudio/ by default). Workbench uses an absolute path as-is.

Set globally, one configuration governs every user:

/etc/rstudio/profiles
[*]
ai-providers-enforced = /etc/rstudio/ai-providers-enforced/default.json

To vary the configuration by group or by user, see Sections and precedence.

Sections and precedence

Like all profile settings, ai-providers-enforced is set within sections that target users by scope:

Section Applies to
[*] All users
[@groupname] Members of the named group
[username] A single user

Workbench reads the file top to bottom and applies every section that matches the user. When more than one sets ai-providers-enforced, the last in file order wins, and Workbench uses that file whole rather than merging the two.

/etc/rstudio/profiles
[*]
ai-providers-enforced = /etc/rstudio/ai-providers-enforced/default.json

[@data-scientists]
ai-providers-enforced = /etc/rstudio/ai-providers-enforced/data-scientists.json

[jsmith]
ai-providers-enforced = /etc/rstudio/ai-providers-enforced/jsmith.json

In this example, a user in no listed group gets default.json, a data-scientists member gets data-scientists.json, and jsmith gets jsmith.json even when also in data-scientists. If a user matches several [@groupname] sections, the last one in the file wins.

The providers.json schema

The file that ai-providers-enforced points to must follow the providers.json schema in posit-dev/ai-lib (packages/ai-config/providers.schema.json). The file is a JSON object with a top-level providers object that contains one entry per provider ID:

/etc/rstudio/ai-providers-enforced/default.json
{
  "providers": {
    "anthropic": { "enabled": true },
    "openai": { "enabled": false }
  }
}

Provider IDs

Each entry under providers corresponds to one of the following recognized provider IDs: anthropic, openai, openai-compatible, gemini, google-vertex, bedrock, snowflake-cortex, databricks, ms-foundry, copilot, positai, deepseek, ollama, lmstudio, openrouter, litellm, portkey, and custom. The special default ID supplies a fallback for providers not named explicitly. It accepts only enabled.

Provider fields

All fields are optional. An omitted field imposes no constraint.

Field Type Description
enabled boolean Whether the provider is available to users
baseUrl string Overrides the provider’s default API base URL
customHeaders object Additional HTTP headers sent with each request to the provider
models object Constrains and augments the models offered for the provider (see Model fields)

Model fields

The models object on a provider entry (for example providers.anthropic.models) accepts:

Field Type Description
allow array of strings Restrict the models offered for the provider to these exact model IDs
deny array of strings Block these exact model IDs
discovery "auto" or "off" Whether to auto-discover the provider’s models. Set to "off" when supplying a fixed model list through custom
custom array of objects Define custom model entries. Each requires at least id, name, maxContextLength, supportsTools, supportsImages, supportsToolResultImages, and supportsWebSearch

Provider-specific credentials

Some providers take an additional object that carries connection or credential settings.

Provider Object Fields
bedrock aws profile, region
google-vertex googleCloud project, location
snowflake-cortex snowflake account, home, host, connectionName

Example

The following configuration disables all providers except two: one with a restricted model list, and one with a custom base URL and connection headers:

/etc/rstudio/ai-providers-enforced/default.json
{
  "providers": {
    "default": { "enabled": false },
    "anthropic": {
      "enabled": true,
      "models": {
        "allow": ["claude-sonnet-4-5", "claude-opus-4-1"]
      }
    },
    "openai-compatible": {
      "enabled": true,
      "baseUrl": "https://llm.internal.example.com/v1",
      "customHeaders": {
        "X-Org-Id": "research"
      }
    }
  }
}

Applying changes

After editing /etc/rstudio/profiles or any file it references, reload Workbench to apply the changes:

Terminal
sudo rstudio-server reload

You do not need a full restart. Reloading re-reads the entire profiles file and any file that ai-providers-enforced references. Sessions launched after the reload use the updated settings. Running sessions keep their launch-time configuration. If Workbench cannot read the referenced file or the file contains invalid JSON, Workbench rejects the reload and keeps the previously loaded configuration. See Reloading configuration values for more about the reload command.

Helm chart configuration

On Kubernetes deployments that use the Workbench Helm chart, there is no host filesystem to place the enforced file on. Supply both the profiles setting and the JSON file itself through config.server in values.yaml. Add the JSON file as its own config.server entry, then point ai-providers-enforced at it from config.server.profiles:

values.yaml
config:
  server:
    ai-providers-enforced.json: |
      {
        "providers": {
          "anthropic": { "enabled": true },
          "openai": { "enabled": false }
        }
      }
    profiles:
      "*":
        ai-providers-enforced: ai-providers-enforced.json

The chart mounts every config.server entry into the same server configuration directory, so ai-providers-enforced.json lands alongside the rendered profiles file. Referencing it with a relative path (rather than an absolute one) lets ai-providers-enforced resolve against that directory automatically, without hard-coding the chart’s mount path.

See the Configuration files section of the Helm chart README for how config.server entries map to files on disk and how config.server.profiles maps to /etc/rstudio/profiles.

Back to top