IP-Based Access Control

IP-Based Access Control is an additional security layer that lets you restrict inbound access to Cast AI services based on the source IP address of each request. You can define IP allowlists or blocklists that apply to your entire organization, ensuring that only traffic from trusted networks reaches the Cast AI console, APIs, and cluster-facing endpoints.

This feature complements Role-Based Access Control (RBAC) and Single Sign-On (SSO). RBAC and SSO verify who is accessing Cast AI; IP-Based Access Control verifies where the request originates.

How it works

When IP-Based Access Control is enabled, Cast AI evaluates the source IP address of every request to your organization against the configured rules. You can choose one of two policy modes:

Mode	Behavior	When to use
Deny-all by default	Only IP addresses and ranges that you explicitly allow can access Cast AI.	Recommended for most organizations. This mode provides the strongest control and ensures that unknown sources cannot reach Cast AI.
Allow by default	All IP addresses can access Cast AI unless you explicitly block them.	Useful when you only need to deny a small number of addresses or ranges.

Rules are configured at the organization level. They apply globally to all inbound traffic, including:

The Cast AI console
Cast AI API requests
Requests from clusters running Cast AI components
Terraform provider calls
Service Account authentication

The feature does not differentiate between traffic types. Once a rule matches a source IP, it applies to all inbound requests from that IP.

Supported IP range formats

You can specify IPv4 addresses and ranges in either of the following formats.

Format	Example	Description
Single IP address	`203.0.113.5`	One specific IPv4 address.
Dash range	`203.0.113.5-203.0.113.25`	A continuous range of IPv4 addresses; both start and end addresses are inclusive.

CIDR blocks and IPv6 are not supported in the current release.

Use cases

Organizations typically use IP-Based Access Control to:

Enforce corporate network access: Require users to access the Cast AI console only from your organization's VPN or office networks.
Restrict machine access: Limit which CI/CD runners, automation hosts, or other machines can call Cast AI APIs.
Add defense in depth: Apply a network-level control on top of identity and role management to reduce the attack surface of your Cast AI organization.

Enablement and configuration

IP-Based Access Control is enabled and configured by Cast AI. To request it for your organization, contact your Cast AI Account Manager. They will work with you to enable the feature and configure the rules based on the IP ranges you provide.

There is no self-service user interface for configuring these rules.

Important considerations

⚠️
Warning
The feature does not detect or warn you if your own IP ranges are missing from the allowlist. If you use deny-all mode and do not include your organization's source IPs, your users and systems may lose access to Cast AI. Verify all required source IPs with your network team before enabling the feature.

⚠️
Warning
Deploying IP-Based Access Control alongside Zscaler requires additional planning. If your organization uses Zscaler, discuss the deployment with Cast AI before enabling the feature.

IP-Based Access Control applies to inbound traffic to Cast AI. It is not the same as allowlisting Cast AI egress IPs for outbound traffic from your clusters. For outbound network requirements, see Communication requirements.

Denied requests are logged with the organization ID, source IP address, and reason for auditing.

Related resources

Role-Based Access Control (RBAC)

Manage user and service account permissions across your organization and clusters.

Communication requirements

Allowlist Cast AI egress IPs for outbound traffic from your clusters.