Access Control and Compliance
Govern who can train, promote, and deploy.
Access Control and Compliance is a free MLOps Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the MLOps Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Govern Who Can Act
Access control decides who is allowed to train, promote, and deploy models, so risky actions never rest with just anyone. 🔐
The Risky Actions
Three actions deserve special care: pushing to production, deleting a model version, and changing data that feeds training.
Use Role-Based Access
RBAC grants permissions to roles, not people. A user gets a role like viewer or deployer, and the role carries the rights.
Least Privilege Wins
Give each role the smallest set of rights it truly needs. Least privilege shrinks the blast radius when an account is misused.
Separate Train from Deploy
Split duties so the person who trains a model is not the one who ships it. This separation of duties catches mistakes early.
Protect the Registry
The model registry is a control point. Restrict who can move a version into the Production stage, since that flips live traffic.
Keep Secrets Out of Code
Credentials never belong in a repo. Pull them from a secrets manager at runtime so keys can be rotated and access logged.
import os
api_key = os.environ["MODEL_API_KEY"]Log Sensitive Access
Tie access control to your audit trail. Record every promotion and deploy with the actor, so compliance can prove who changed what. 🧾
Compliance and PII
Rules like GDPR govern personal data. Mind PII in features and logs, and honor requests to delete a user's records.
Require Approvals
For high-stakes models, add a human gate. A required approval before production deploy forces a second pair of eyes.
Review Access Regularly
Permissions drift over time. Run periodic access reviews to revoke rights people no longer need before they become a risk.
Quick Check
Recall the principle behind granting only the rights a role needs.
Recap
You learned to govern ML with RBAC, least privilege, separation of duties, secrets management, and audit-backed compliance. ✅
Frequently asked questions
Is the “Access Control and Compliance” lesson free?
Yes — the full text of “Access Control and Compliance” is free to read here on the web, and the MLOps Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the MLOps Academy course, upgrade to CoddyKit PRO.
What will I learn in “Access Control and Compliance”?
Govern who can train, promote, and deploy. You practise MLOps Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start MLOps Academy?
No prior experience is required. MLOps Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Access Control and Compliance” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this MLOps Academy lesson?
Yes. Every MLOps Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Trace Data-to-Model Lineage
- Write Model Cards
- Audit Trails and Reproducibility
- Access Control and Compliance