Studio executes all Treasure AI operations using your existing credentials — your organization's PBP policies and IP allowlists apply to those operations automatically. Studio itself does not have its own access control layer.
To prevent PII from being sent to external LLM providers (Bedrock, OpenAI, etc.) when agents run inference, configure column-level masking at the data layer. The masking carries through Studio agents and custom skills automatically. See Configure column-level access control to keep PII out of LLMs.
Studio authenticates through Treasure AI SSO and uses your TD credentials for all data operations. Access to databases, tables, and APIs is governed by your organization's Treasure AI policies — Studio passes your credentials through, it does not enforce its own access controls.
Understand how your organization's Treasure AI access controls interact with Treasure AI Studio.
- A Treasure AI account
- Familiarity with Security Overview
Studio does not introduce a new permissions layer. Every query, segment push, and API call the AI executes goes through your Treasure AI account using your credentials. Your organization's Policy-Based Permissions govern what the AI can and cannot access.
The AI operates with your credentials. If PBP restricts your access to a database, the AI receives the same "permission denied" error you would see in the console. Studio does not elevate or bypass your permissions.
During sign-in, Studio obtains an OAuth access token from Treasure AI. This token is stored server-side and used to authenticate all Treasure AI API requests made by the AI. No permission logic runs inside Studio itself — enforcement is entirely at the Treasure AI API layer.
If your organization uses Treasure AI's IP allowlist to restrict API access to approved networks, Studio's architecture is designed to work within those boundaries. Most users do not need to take any action here — this is an administrator configuration task.
Studio connects to the Treasure AI API from a fixed set of outbound IP addresses. These addresses are static — they do not change between sessions or deployments.
If your organization has a Treasure AI IP allowlist configured, you must add Studio's outbound IPs to the allowlist. Without this step, the AI's queries and API calls will be blocked by Treasure AI's network policy.
The following outbound IP addresses are used by Studio. If your organization has an IP allowlist configured, add these addresses for your region.
34.199.15.172
100.51.233.143
54.175.7.102Studio itself does not restrict inbound access by IP address. Once authenticated through Treasure AI SSO, you can access the Studio web application from any network.
If your organization uses both Treasure AI's IP allowlist and network-based access controls, be aware of how network changes affect your session:
| Scenario | Studio UI | TD Operations (Queries, API Calls) |
|---|---|---|
| You stay on the same allowed network | Works normally | Works normally |
| You move to a disallowed network after login | Works normally (Studio UI is not IP-restricted) | Works normally (Studio workers use fixed outbound IPs, not your client IP) |
| You attempt to log in from a network blocked by your IdP | Login fails (TD SSO enforces your IdP's network policy) | Not applicable — no session established |
Treasure AI is the identity provider (IdP) for Studio. IP allowlist checks apply during the OAuth authentication flow — your organization's IdP policy determines which networks can initiate a login. After authentication, Studio makes all Treasure AI API calls from fixed outbound IP addresses, independent of your client's network location. Studio does not re-check client IP addresses after login.
By default, all authenticated users with a valid Treasure AI account have full access to AI features in Studio. Account administrators can cap how many credits each user can consume per day through Credit Policy (a self-service setting), and can restrict Studio to specific users once restricted (opt-in) mode has been enabled for the account (contact your Customer Success Manager to request it). There are no finer-grained per-feature restrictions within Studio in the current release.
| Access Control | Current Behavior |
|---|---|
| AI and LLM access | All users who have been granted access to Studio — no per-feature restrictions |
| Per-user Studio access | Account administrators can restrict Studio to specific users once restricted mode is enabled (contact your Customer Success Manager) — see Controlling AI Studio access per user |
| Per-user usage limits | Account administrators can set a per-user daily credit limit — see Credit Policy |
| Per-feature restrictions within Studio | None — users who can access Studio have all features available |
| Per-account opt-out | Available — contact your Customer Success Manager to disable Studio for your account |
| Admin-only features | Network Audit Log and Network Policy require the account_admin role (Security Overview for details) |
By default every user has access to Studio. Administrators can restrict Studio to specific users (Controlling AI Studio access per user) and cap each user's daily credit consumption (Credit Policy). Finer-grained per-feature flags do not exist in the current release.
| Layer | What It Controls | Where It Is Enforced | Action Required |
|---|---|---|---|
| Policy-Based Permissions (PBP) | Database, table, and API access per user/group | Treasure AI API (server-side) | None — existing PBP policies apply automatically |
| TD IP Allowlist | Which IPs can call the Treasure AI API | Treasure AI API (server-side) | Add Studio's outbound IPs if an allowlist is configured |
| Studio Inbound Access | Which IPs can reach the Studio web application | Not enforced — no IP restriction | None |
| AI Feature Access | Which users can use AI capabilities | All authenticated users who can access Studio | None — all features available to users who can access Studio |
| Per-User Studio Access | Whether each user may access Studio at all | Treasure AI API (server-side) | Contact your Customer Success Manager to enable restricted mode, then grant access to specific users (per-user access) |
| Per-User Usage Limit | How many credits each user can consume per day | Treasure AI Studio (Credit Policy) | Account admin can set a daily credit limit (Credit Policy) |
| Account Opt-Out | Disable Studio for an entire account | Treasure AI account settings | Contact CSM if needed |
Access control is enforced by Treasure AI, not Studio. No Studio-specific verification steps are required.
| Issue | Solution |
|---|---|
| Queries fail after your organization enabled an IP allowlist | Studio's outbound IPs may not be in the allowlist. Contact your CSM to obtain the current IP addresses and add them to your Treasure AI IP allowlist configuration |
| Login fails from a specific network | Your organization's identity provider may enforce network-based access policies. Try logging in from an approved network, or contact your IT administrator to update the IdP policy |
- Security Overview — Architecture, data protection, and audit logging
- SSO Login — Authentication flow details
- Getting Started — Platform setup guide
- Core Concepts — Work Folders, models, and credits