Portal roles and permissions
This page lists the system roles of the Lakehouse portal and every permission you can give a custom role. Use it to pick the right role for a person, or to build a custom role.
System roles
| Role | For |
|---|---|
portal_admin | Administering the whole portal: users, groups, roles, sessions, and every feature. |
policy_manager | Managing data access in Data Security, and viewing users, groups, service accounts, and the Audit log. |
data_engineer | Operating data: queries, Data Explorer, catalogs, Time Machine, and Lakehouse Janitor. |
data_analyst | Analyzing data: queries, saved queries, Data Explorer, and Time Machine. |
viewer | Nothing yet. This role has no permissions and marks users who wait for access. |
A user with several roles gets every permission from all of them combined. To give someone a narrower set, for example browsing only, create a custom role. See Manage roles and assign them to users.
Permissions by role
"Yes" means the system role includes the permission.
| Permission | Lets the user | portal_admin | policy_manager | data_engineer | data_analyst | viewer |
|---|---|---|---|---|---|---|
| Users | ||||||
users:read | View the user list and user details. | Yes | Yes | — | — | — |
users:create | Create users. | Yes | — | — | — | — |
users:update | Edit a user's name, status, and roles. | Yes | — | — | — | — |
users:delete | Remove users permanently. | Yes | — | — | — | — |
users:roles:assign | Assign roles to users. | Yes | — | — | — | — |
users:roles:revoke | Remove roles from users. | Yes | — | — | — | — |
| Sessions | ||||||
sessions:read | View the Sessions page. | Yes | — | — | — | — |
sessions:revoke | Sign users out by revoking their sessions. | Yes | — | — | — | — |
| Groups | ||||||
groups:read | View groups and their details. | Yes | Yes | — | — | — |
groups:write | Create, edit, and delete groups, and manage their members. | Yes | — | — | — | — |
| Roles | ||||||
rbac:roles:read | View roles and their permissions. | Yes | — | — | — | — |
rbac:roles:write | Create, edit, and delete custom roles, and set their permissions. | Yes | — | — | — | — |
permissions:read | View the list of portal permissions when you set up a role. | Yes | — | — | — | — |
| Queries | ||||||
query:execute | Run SQL in Query Editor. | Yes | — | Yes | Yes | — |
query:saved.manage | Save, rename, and delete your own saved queries. | Yes | — | Yes | Yes | — |
| Data Explorer | ||||||
data_explorer:browse | Open Data Explorer, browse the catalog tree, and view schema, properties, and DDL. | Yes | Yes | Yes | Yes | — |
data_explorer:preview | View the Sample data tab, up to 100 rows. | Yes | — | Yes | Yes | — |
resources:read | Browse catalogs, schemas, tables, and columns. | Yes | Yes | — | — | — |
| Time Machine | ||||||
time_machine:read | View the snapshot timeline and preview past versions of a table. | Yes | — | Yes | Yes | — |
time_machine:metadata_diff | Compare the structure of a table between two snapshots. | Yes | — | Yes | Yes | — |
time_machine:data_diff | Compare the data of a table between two snapshots. | Yes | — | Yes | Yes | — |
time_machine:config:read | View the resource limits of Time Machine. | Yes | — | Yes | — | — |
time_machine:config:update | Change the resource limits of Time Machine. | Yes | — | Yes | — | — |
| Lakehouse Janitor | ||||||
maintenance:read | View jobs, runs, settings, and run history. | Yes | — | Yes | — | — |
maintenance:manage | Start, cancel, import, pause, and resume jobs, and change default settings. | Yes | — | Yes | — | — |
| Data Security | ||||||
governance:permissions:read | View access policies. | Yes | Yes | — | — | — |
governance:permissions:grant | Create access policies and grant permissions in them. | Yes | Yes | — | — | — |
governance:permissions:revoke | Remove permissions from access policies. | Yes | Yes | — | — | — |
governance:permissions:delete | Delete access policies. | Yes | Yes | — | — | — |
governance:row_policies:read | View row level filter policies. | Yes | Yes | — | — | — |
governance:row_policies:write | Create, edit, activate, and deactivate row level filter policies. | Yes | Yes | — | — | — |
governance:masking_policies:read | View masking policies. | Yes | Yes | — | — | — |
governance:masking_policies:write | Create, edit, activate, and deactivate masking policies. | Yes | Yes | — | — | — |
| Audit | ||||||
audit:read | View the Audit log page in Access management. | Yes | Yes | — | — | — |
query_audit:read_all | View the query access audit of every user in Query access audit. | Yes | — | — | — | — |
query_audit:read_self | View the query access audit of your own queries in Query access audit. | — | — | — | — | — |
| Service accounts | ||||||
service-accounts:read | View service accounts. | Yes | Yes | — | — | — |
service-accounts:manage | Create, rotate, disable, enable, delete, and restore service accounts. | Yes | — | — | — | — |
Portal permissions and data access
Portal permissions decide which pages and buttons a user sees. They do not decide which data the user can read.
data_explorer:browseopens Data Explorer. The catalogs, schemas, and tables the user sees depend on access rules in Data Security.service-accounts:managecreates a service account. The account reads data only after you add it to an access rule in Data Security.
Removing a portal permission does not change a user's access rules in Data Security.