Agent skill · software engineering · jeremylongshore
groq-enterprise-rbac
Use when you run Groq inference for multiple teams and need per-team model allow-lists, spending caps, rate limits, and key rotation — because Groq API keys have no built-in scopes, so access control must live in your gateway. Configure Groq organization management, API key scoping, spending controls, and team access patterns. Trigger with phrases like "groq organization", "groq RBAC", "groq enterprise", "groq team access", "groq spending limits", "groq multi-team".
Why this skill is useful
Adds a complete implementation for managing multi-team access control to Groq's API, including key rotation and spending limits, which the AI cannot generate from existing knowledge.
What it needs
Requires groq-sdk, p-queue installed locally. Requires groq account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Groq Enterprise Access Management Overview Manage team access to Groq's inference API through API key strategy, model-level routing controls, spending limits, and usage monitoring. Groq uses flat API keys (gsk prefix) with no built-in scoping -- access control is implemented at the application layer, in a gateway that sits between your teams and Groq. Groq Access Model API keys are per-organization, not per-user No built-in scopes -- every key has full API access Rate limits are per-organization, shared across all keys Spending limits are configurable in the Groq Console Projects allow creating isolated API keys with separate limits Prerequisites A Groq organization with Console access (console.groq.com) and billing configured. Permission to create Groq Projects — one per team/service, each yielding its own gsk key. A secret manager (AWS Secrets Manager, GCP Secret Manager, Vault, etc.) to store per-team keys. A gateway/service layer (Node/TypeScript in these examples) that every team's traffic passes through — Groq enforces nothing per-team, so your gateway is the control point. groq-sdk and p-queue installed if you use the reference gateway. Instructions Access control is enforced in your own gateway. The full, copy-paste implementation for every step lives in references/implementation.md; the high-level flow: 1. API key strategy — one Groq Project (and key) per team/environment, named {team}-{environment}-{purpose}. Register keys in a lookup: 2. Model access control — define a per-team config (allowedModels, maxTokensPerRequest, monthlyBudgetUsd, rateLimitRPM) and a validateRequest(team, model, maxTokens) guard that throws before any unauthorized model or oversized request reaches Groq. 3. API gateway — groqGateway(team, messages, model, maxTokens) validates permissions, checks the monthly budget, rate-limits per team via p-queue, calls Groq with the team's key, and records usage. 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/groq-enterprise-rbac