Permission reference

This page lists every permission, with what it allows and which permissions it includes. Use it when you choose the permissions for a role, or when you need to know why a preset does or does not cover a task. For how roles and permissions combine for a user, read How access works.

Read the three tiers

The permission editor sorts permissions into three tiers, and every category uses the same three:

A role can hold any mix of them. In the editor, permissions are grouped into twelve categories, each with its own icon: Workflow Management, User & Role Management (shown as Users & Roles), System Administration (shown as Administration), PII, Query Editor, Data Layer, Minds, DataMind Oda, Slides, DataPrism, Observability and Platform. Below, each category has one table with every permission in it, in the editor's order. Section is the label the permission sits under inside its category, such as Lake, Warehouse or AI in SQL (High-Level presets have none). Includes lists the permissions that come with it.

Permissions for a specific area are described on that area's page: see Lake, Warehouse, Workflows, Minds, Slides and DataPrism.

Find a permission in a role

1. Open Admin > Profile Management > Roles.
2. Open the role and click Permissions.
3. Type a name in Search permissions to jump to.... The editor moves to the permission and highlights it briefly.

The same editor opens from the Permissions action on a user's page. The editor shows Users & Roles for User & Role Management and Administration for System Administration; the other categories keep their own names. Permission names are fixed product names: the permission audit and exports use them, and renaming a permission is not supported. A grant is matched by its exact name: when a permission is renamed, every role and user that holds it is moved to the new name, so holders keep their access; a stored name that matches no permission grants nothing, and nothing warns about it.

Workflow Management

This category holds 27 permissions.

Users & Roles

This category holds 53 permissions.

Administration

This category holds 38 permissions.

PII

This category holds 12 permissions.

Query Editor

This category holds 5 permissions.

Data Layer

This category holds 23 permissions.

Minds

This category holds 57 permissions.

DataMind Oda

This category holds 28 permissions.

For how the agent works, read the DataMind Oda overview.

Slides

This category holds 35 permissions.

DataPrism

This category holds 47 permissions.

Observability

This category holds 44 permissions.

Platform

This category holds 16 permissions.

How presets behave

• Users Administrator includes 2FA Manager, 2FA User and API Token Administrator. It does not include User Impersonation, which you grant separately.
• 2FA Manager includes Manage Global 2FA. That permission is needed to change the platform-wide two-factor mode, and System Settings Manager does not replace it. See Sign-in security.
• Changing the sandbox allowed hosts, which control what DataPrism custom visuals may load, needs Password Policy Manager. It is not a DataPrism permission. See Scheduler, health, maps and connector safety.
• Create API Tokens lets a user create personal access tokens. Revoking it disables every token the user already holds, and each token scope needs its own permission. A token can never create another token. See API tokens.
• Manage Others API Tokens covers seeing other people's tokens and revoking them. It is part of API Token Administrator.
• Creating a chart API token needs both Manage DataPrism API Tokens and Export DataPrism Report Data; the DataPrism API Token Manager set includes both.
• Semantic models are not shared on their own; access flows through DataPrism workspaces. See DataPrism permissions.
• Switching a custom visual off so it stops running in viewers' browsers is its own permission, DataPrism Custom Visual Disabler, separate from authoring custom visuals.
• Use Slides AI is granted on its own; it never comes from a Minds permission. See Slides permissions.
• AI in SQL User, in the Data Layer category under the section AI in SQL, holds Use AI in SQL: the person can call the six AI functions in SQL while the company setting AI in SQL is on. Data Layer Administrator does not include it, so grant it on its own. See AI in SQL.
• Impersonate Users lets a user act as someone else across the platform. The actions are real and are recorded against both identities, and private chats stay hidden. See Impersonate a user.
• Admin Configurator includes AI Skills Manager, and Admin Viewer includes AI Skills Viewer. Roles that held View DataMind Oda Settings or Edit DataMind Oda Settings when skills arrived also received View AI Skills or Edit AI Skills. View AI Skills gives read access to the skills of every Mind in the company, also of Minds the user cannot open.
• View AI Skills also reads the tests of organisation skills and Mind skills in AI Configuration. Edit AI Skills also lets you benchmark an organisation skill in a Mind you manage, from that Mind's Skills tab, which needs View Mind Skills too. See Organisation skills.
• The skill permissions of Minds are in the Minds category. See Who can do what with Minds.
• Others' Tasks Editor, in the Minds category, holds Edit Others Tasks: pause, resume and reschedule scheduled tasks created by other users, while the prompt, Mind and model stay with the creator. Minds Administrator and Tasks Manager do not include it, so grant it on its own; the Admin role has it. See Scheduled Tasks.
• ETL Locks Manager, in the Observability category, is described as "View ETL locks, abort their holders and release stale locks". It holds View Active Queries and Manage ETL Locks ("Abort the holder of an ETL lock and release stale ETL locks"). Observability Administrator includes it and Observability Viewer does not. Reading the Locks view needs only View Active Queries or Manage ETL Locks; a Lake, Warehouse or WriteBack permission does not open it. See ETL locks.
• DataMind Oda in Excel is its own bundle, and the DataMind Oda user tiers do not include it: grant it on its own, or give the person DataMind Oda Admin.
• DataMind Oda Unrestricted Mode comes with DataMind Oda Admin and DataMind Oda Full Access User; DataMind Oda Integrations Manager also comes with DataMind Oda Power User; DataMind Oda Developer and DataMind Oda Private Logging come only with DataMind Oda Admin.
• A Minds preset never grants a DataMind Oda permission; Mind access and Oda access are separate grants.
• The built-in Admin role always has every permission. The editor shows them all as granted and locks them.

Questions, answered

What is the difference between a preset and a standard permission?

A High-Level preset is a broad bundle across an area, such as Users Administrator. A Standard permission covers one task, such as 2FA Manager, and can contain several Granular permissions. Granular permissions are the single low-level rights.

Does Users Administrator let someone impersonate users?

No. User Impersonation is a Standard permission that you grant separately, on top of any preset.

Which preset gives full control of the administration settings?

Admin Configurator gives full administrative access to AI, system settings, SSO, DataMind Oda settings, notifications and appearance, and it includes the password policy. Users, roles and PII are not part of it, so grant those separately.

I cannot find a permission an older guide mentions. Where is it?

It has a new name. Granular permissions now follow one naming pattern, for example Create Users instead of Add User and Create/Edit Lake Objects instead of Add/Modify Lake Objects. Roles and users that held the old name keep the same access under the new one. Search the editor by the new name, or find it in the tables above.

Who can download the permission audit?

Permission Audit Downloader. It is the only bundle that includes Export Permission Audit, which the download needs; Permission Audit Viewer includes only View Permission Audit. The workbook is described in Permission audit workbook.

What happens if I revoke Create API Tokens?

Every token the user already holds is disabled.

Which permission lets someone list and revoke other people's API tokens?

Manage Others API Tokens. It covers other people's token lists and revoking their tokens, and it is part of API Token Administrator. See API tokens.

Does a chart API token need extra permissions?

Yes. A chart API token needs both Manage DataPrism API Tokens and Export DataPrism Report Data. See Export reports and data.

Which permission lets someone abort a stuck load from the Locks view?

Manage ETL Locks, which the ETL Locks Manager preset bundles with View Active Queries. It also releases stale locks. Observability Administrator includes it. See ETL locks.

Which permission lets a user continue after a PII warning?

PII Detection Bypass. It applies in warn mode, and PII Administrator includes it. See PII checks in chat.