Orgs should be able to agree to 3rd party use agreements so their members can access 3rd party models

[asglover]

Feature request

for CI / CD the only way to get a sane workflow is to make a fake single user that the whole company uses to access the 3rd party resources. This undercuts your enterprise options and the idea that all users should log in as themselves. I know it's probably some legal hangup, but as is you are undercutting your enterprise offerings and your security.

Motivation

I want to have my org be able to use hugging face in our CI/CD platforms. but I can't ask all our users to sign in and agree to a constantly increasing number of agreements. So instead I make a fake account that everyone shares. This is bad for you and me.

Your contribution

I would use your product if you made it. I would pay money for the team or enterprise for this feature, where currently there is no incentive to do that.

[VioletteLepercq]

Hey Austin,
Should we discuss the above over email instead? Can you please contact me at violette@huggingface.co ?
An enterprise set up for your org account on the HF platform would allow you to do what you described in your issue.

[asglover]

Are you referring to your OAuth Token Exchange service?
In the limitations it makes it sound like it explicitly cannot be used to solve this problem

https://huggingface.co/docs/hub/en/oauth#security-considerations

Organization-scoped: Tokens can only access resources within your organization (models, datasets, Spaces owned by the org).
No personal access: Tokens cannot access the user’s personal private repositories or resources from other organizations.

Is this true or not? What is your proposed workflow?

[VioletteLepercq]

One option is to create a Git clone and then push it to a private repository within the organization, though you’ll need to check the licensing implications.

Alternatively, we create a service account, have it accept the model’s terms, and then generate a token (ideally a fine-grained one scoped to the repository). Users then use that token to access the model.

But yeah, I confirm, there’s no built-in feature for that; for now, acceptance is necessarily tied to a user. This has been requested several times, so maybe there will be a solution soon.

[asglover]

Hi Violette,
Thanks for being transparent, I appreciate it!

Copying it into the org is a reasonable workout, but even git cloning is somewhat heavy weight (vs having a 'mirror' functionality in HF).

The service account solution is essentially make-and-share-one-account.

If there is development on this feature please let me know! It's the kind of QoL thing that would really justify the product.

Feel free to close or mark as duplicate or whatever you prefer. Thanks for following up on this!

• Austin