Capability role enforcement begins November 16
Published November 12, 2026 · Takes effect 5:00 PM ET, Monday, November 16, 2026
Starting at 5:00 PM ET on Monday, November 16, 2026, capability roles control who can create API keys and who can use Agent Builder and API passthrough on chat.asksage.ai and chat.civ.asksage.ai.
Action for organization administrators. Before 5:00 PM ET on Monday, November 16, give the Developer role to every member who needs to create API keys, for example for scripts, integrations, or coding tools. Members whose role is already General don’t get Developer automatically. Also make sure API keys enabled is on in Organization Settings: if it’s off, your members’ existing API keys stop working when enforcement begins. See What to do now.
Table of contents
Where this applies
| Deployment | Enforcement starts |
|---|---|
| https://chat.asksage.ai | Monday, November 16, 2026, 5:00 PM ET |
| https://chat.civ.asksage.ai | Monday, November 16, 2026, 5:00 PM ET |
Other Ask Sage–hosted deployments will be enabled on timelines agreed with each customer. Your Ask Sage account team will confirm the date for your deployment before anything changes. Self‑hosted and Ask Sage Edge deployments control this setting themselves.
Background
Every user has a capability role: Developer, General, or Restricted. Capability roles arrived with v3.0.0. Administrators have been able to assign them since v3.10.0, and to change them for many members at once since v3.12.0.
Until now, the role didn’t limit what a user could do on these deployments. From 5:00 PM ET on November 16, Ask Sage enforces it. This is a configuration change, not a new release, so there’s nothing to install.
What changes
| Role | From November 16 |
|---|---|
| Developer | No change. |
| General | Can’t create new API keys. API keys they already have keep working while the organization’s API keys enabled setting is on. Everything else is unchanged. |
| Restricted | Can’t create API keys, use Agent Builder, or use API passthrough: the OpenAI‑, Anthropic‑, and Gemini‑compatible endpoints, and tools such as Claude Code and Codex that connect through them. Sees only activated MCP servers. Chat, Workbook, and Model Compare are unchanged. |
| Not set | Gets a role the next time they use Ask Sage: Developer if they have an active API key, otherwise the organization’s default role, otherwise General. |
| Bot accounts | No change. |
Two more changes take effect at the same time:
- Moving a member out of Developer revokes their API keys. When an administrator changes a member from Developer to General or Restricted, all of that member’s active API keys are revoked immediately. This applies to single changes, group changes, and default‑role moves. A revoked key can’t be restored, and Undo on the Member Roles page doesn’t bring it back.
- The API keys enabled organization policy applies. If your organization has turned API keys enabled off, no member can create a key, whatever their role. Existing API keys, and the access tokens issued from them, also stop working while the setting is off, so scripts and integrations that use them fail. They work again when the setting is turned back on: turning it off doesn’t revoke or delete any key.
For the full list of what each role allows, see Capability roles.
What to do now
Organization administrators:
- Find the members who need to create API keys. In User Management, check the Role column. Members who use scripts, integrations, or coding tools such as Claude Code or Codex usually need keys.
- Give those members the Developer role. Change one member at a time from User Management, or many at once from Member Roles. See Members and Roles and Member Roles. Members whose role is Not set and who already have an active key become Developer on their own. Members who are already General don’t.
- Check your organization’s API key policy. In Organization Settings, under API Keys, make sure API keys enabled is on if your members use API keys. If it’s off when enforcement begins, no one can create keys, and every existing key in your organization stops working until you turn it on. See Organization Settings.
- Before you move anyone out of Developer, make sure they no longer need their API keys.
What members see
- If their role doesn’t allow API keys, the API Keys item no longer appears in their account settings. Keys they already have keep working for the features their role allows, while the organization’s API keys enabled setting is on.
- Agent Builder and API passthrough requests from a Restricted member are refused with a “Not found” response.
- Members who need to create API keys should ask their organization administrator for the Developer role.
Questions
Contact your organization administrator, your Ask Sage account team, or support@asksage.ai.