# Self-Service Access to AI Workbenches for Your Developers

Provide developers, data scientists, researchers, and all cloud users with self-service access to AI Workbenches using proven templates with guardrails included.

### Why AI Workbenches-as-a-Service?

Every modern enterprise is leveraging AI. Enterprises that streamline the process of learning and experimenting with AI by providing self-service for developers and data scientists gain significant benefits.

### Speed AI Journey

Empower developers and data scientists to deploy AI environments they need, when they need them.

### Reduce Overhead

Reusable AI templates reduce the need for platform and cloud teams to provision environments repeatedly.

### Simplify Maintenance

Platform teams now update and maintain configurations via a set of reusable templates.

## Unique Rafay Capabilities for AI Workbenches-as-a-Service

Dozens of enterprise platform teams leverage these unique features to rapidly build AI Workbenches-as-a-service automation with Rafay and delight their developers.

### Lifeycle Management

- **Secure self-service for namespaces**: Users should be able to provision namespaces but should not have access to resources outside of their namespaces.
- **Infrastructure as Code (IaC) support**: Support for TF or GitOps first approaches, including private Git repos, that accelerate infrastructure deployment.
- **Resource quotas for teams & applications**: Define quotas to prevent noisy neighbor issues so total namespace resource requests do not exceed the configured limits.
- **Management of namespace compliance**: Easily manage compliance of pre-existing namespaces in the same manner (i.e. same guardrails) as new namespaces.
- **Integrate with continuous delivery**: Work with CD tools like Argo, enforcing guardrails (e.g. quotas, network policies) on namespaces created out of band.
- **Centralized visibility into namespaces**: Use cross account and cross cloud visibility to manage complex multi-cloud environments across teams, geos, and domains.
- **Streamlined disaster recovery**: Leverage one step workflows to quickly and safely restore data from backups during disaster recovery events.

### Developer Self-Service

- **Flexible interfaces**: Ability to consume the platform through the preferred interface: UI, Backstage, GitOps or CMDBs (e.g. ServiceNow).
- **Simple, streamlined process for requesting compute**: No time consuming ticket-driven process where the Platform team has to manually provision namespaces.
- **Visualization of namespace resources**: View into "what resources" are violating policies so that it is easy to remediate and course correct (for future actions).
- **Streamlined experience for kubectl access**: To help with scenarios such as application right-sizing exercises or requesting the platform team for additional compute.
- **Repository of approved applications**: Integrated, low touch experience for installing applications that have been scanned for vulnerabilities etc.

### Governance

- **Network policies for namespace isolation**: Enforce network policies so that namespaces belonging to different teams cannot communicate with each other.
- **Just in Time (JIT) user identity driven access**: Implement RBAC at scale with your Identity Provider, without implementing expensive solutions (bastion, VPN, etc.) so users access only their namespaces.
- **Centralized kubectl access audits**: Centralized visibility into user activities + ability to export audits to an external system (e.g. Splunk, Datadog).
- **Chargeback and showback**: Collect cluster utilization metrics for chargeback / showback models, including sharing costs across tenants for unallocated resources and common services.
- **Identify underutilized namespaces**: Collect of Granular utilization metrics from namespaces to show usage by CPU, Memory.
- **Centralized policy enforcement**: Enforce policies for security, reliability and operational efficiency, with centralized visibility into policy violations.
- **Compliance benchmarks**: Run periodic scans against benchmarks (CIS, NSA hardening recommendations etc.) and centrally aggregate the benchmark reports.

### Deployment Features

- **SaaS based**: The default option – providing maximum efficiency and reliability for mature and growing customers.
- **Self-hosted**: A self-hosted, airgapped option may be necessary for highly regulated industries.
- **Multi-tenant**: “Namespace as a service” across multiple teams, with isolation and tight access controls.