Short answer: Yes with Prefect Cloud; not really with self-hosted Prefect Server. - In Prefect Cloud (3.x), the isolation boundary is a Workspace (think “namespace”). You can give Team A access only to Workspace A and Team B access only to Workspace B. Deployments, work pools, blocks, variables, automations, runs, and concurrency limits are all scoped to a workspace. - RBAC lets you control what users can do within a workspace (Viewer, Runner, Developer, Owner, Worker). Enterprise adds Teams (group-based assignments), custom roles, and object-level ACLs to lock down specific deployments, work pools, or blocks even further. Key docs: - Workspaces overview and management: Workspaces (Cloud) - Roles and permissions (RBAC): Manage roles - Teams (Enterprise): Manage teams - Object-level ACLs (Enterprise): Object access control lists - Cloud vs Server (capabilities): Prefect Server concepts If you’re self-hosting Prefect Server (OSS), there’s no native RBAC or workspaces, so you can’t restrict users to their own “namespace.” The common workaround is to run separate Server instances (separate databases) per tenant or move to Prefect Cloud for built-in multi-tenancy. Can you share whether you’re on Prefect Cloud or self-hosted (and which plan)? I can outline the exact steps to set this up for your environment.

Short answer: Not natively in self-hosted Prefect Server. - Prefect Server (OSS) does not have workspaces or RBAC, so you can’t isolate Team A and Team B to separate “namespaces” inside a single Server instance. - What you can do is approximate multi-tenancy by infrastructure separation and front-door controls: - Run separate Server stacks per tenant (separate databases, services, and API URLs). This is the most reliable isolation model. - Put each Server behind a reverse proxy (Nginx/Traefik) with authn/z rules, or enable basic auth at the Prefect API to require credentials. - Isolate at the network layer (VPC, firewall, namespaces) and use distinct worker pools per tenant that only point to their tenant’s Server. - Keep tenant code, blocks, and storage isolated (separate buckets, secrets, repos). Helpful docs: - Self-host with Helm: Self-host the Prefect Server with Helm - Security and basic auth settings: Security settings - Server concepts and Cloud differences: Prefect Server concepts If you share your infra (Kubernetes vs VMs) and how many tenants you need, I can suggest a concrete layout (namespaces, Helm values, ingress, secrets, and CI/CD patterns) to implement clean per-tenant isolation.