Permission reference

This page lists what each permission preset and standard permission allows. Use it when you choose the permissions for a role, or when you need to know why a preset does or does not cover a task. For how roles and permissions combine for a user, read How access works.

Read the three tiers

The permission editor sorts permissions into three tiers, and every category uses the same three:

A role can hold any mix of them. In the editor, permissions are grouped into twelve categories, each with its own icon: Workflow Management, User & Role Management (shown as Users & Roles), System Administration (shown as Administration), PII, Query Editor, Data Layer, Minds, DataMind Oda, Slides, DataPrism, Observability and Platform. The tables below cover the High-Level presets in every category, and the Standard permissions for users, roles, administration and PII. Inside a category, permissions sit under section labels such as Lake, Warehouse, WriteBack, Training Cards, Two-Factor Authentication, API Tokens, AI Configuration, DataMind Oda Settings, Password Policy, Decks, AI (the Slides AI section), Semantic Models, Custom Visuals, Extensions, Advanced and Collaboration.

Permissions for a specific area are described on that area's page: see Lake, Warehouse, Workflows, Minds, Slides and DataPrism.

Find a permission in a role

1. Open Admin > Profile Management > Roles.
2. Open the role and click Permissions.
3. Type a name in Search permissions to jump to.... The editor moves to the permission and highlights it briefly.

The same editor opens from the Permissions action on a user's page. The editor shows Users & Roles for User & Role Management and Administration for System Administration; the other categories keep their own names. Permission names are fixed product names: the permission audit and exports use them, and renaming a permission is not supported. A grant is matched by its exact name: when a permission is renamed, every role and user that holds it is moved to the new name, so holders keep their access; a stored name that matches no permission grants nothing, and nothing warns about it.

High-level presets

For how the agent works, read the DataMind Oda overview.

Standard permissions for users and roles

Standard permissions for administration

Standard permissions for PII

How presets behave

• Users Administrator includes 2FA Manager, 2FA User and API Token Administrator. It does not include User Impersonation, which you grant separately.
• 2FA Manager includes Manage Global 2FA. That permission is needed to change the platform-wide two-factor mode, and System Settings Manager does not replace it. See Sign-in security.
• Changing the sandbox allowed hosts, which control what DataPrism custom visuals may load, needs Password Policy Manager. It is not a DataPrism permission. See Scheduler, health, maps and connector safety.
• Create API Tokens lets a user create personal access tokens. Revoking it disables every token the user already holds, and each token scope needs its own permission. A token can never create another token. See API tokens.
• Manage API Tokens Of Other Users covers seeing other people's tokens and revoking them. It is part of API Token Administrator.
• Creating a chart API token needs both Manage DataPrism API Tokens and Export DataPrism Report Data; the DataPrism API Token Manager set includes both.
• Semantic models are not shared on their own; access flows through DataPrism workspaces. See DataPrism permissions.
• Switching a custom visual off so it stops running in viewers' browsers is its own permission, DataPrism Custom Visual Disabler, separate from authoring custom visuals.
• Use Slides AI is granted on its own; it never comes from a Minds permission. See Slides permissions.
• Impersonate User lets a user act as someone else across the platform. The actions are real and are recorded against both identities, and private chats stay hidden. See Impersonate a user.
• DataMind Oda in Excel is its own bundle, and the DataMind Oda user tiers do not include it: grant it on its own, or give the person DataMind Oda Admin.
• DataMind Oda Unrestricted Mode comes with DataMind Oda Admin and DataMind Oda Full Access User; DataMind Oda Integrations Manager also comes with DataMind Oda Power User; DataMind Oda Developer and DataMind Oda Private Logging come only with DataMind Oda Admin.
• A Minds preset never grants a DataMind Oda permission; Mind access and Oda access are separate grants.
• The built-in Admin role always has every permission. The editor shows them all as granted and locks them.

Questions, answered

What is the difference between a preset and a standard permission?

A High-Level preset is a broad bundle across an area, such as Users Administrator. A Standard permission covers one task, such as 2FA Manager, and can contain several Granular permissions. Granular permissions are the single low-level rights.

Does Users Administrator let someone impersonate users?

No. User Impersonation is a Standard permission that you grant separately, on top of any preset.

Which preset gives full control of the administration settings?

Admin Configurator gives full administrative access to AI, system settings, SSO, DataMind Oda settings, notifications and appearance, and it includes the password policy. Users, roles and PII are not part of it, so grant those separately.

Who can download the permission audit?

Permission Audit Downloader. It is the only bundle that includes Download Permission Audit, which the download needs; Permission Audit Viewer includes only View Permission Audit. The workbook is described in Permission audit workbook.

What happens if I revoke Create API Tokens?

Every token the user already holds is disabled.

Which permission lets someone list and revoke other people's API tokens?

Manage API Tokens Of Other Users. It covers other people's token lists and revoking their tokens, and it is part of API Token Administrator. See API tokens.

Does a chart API token need extra permissions?

Yes. A chart API token needs both Manage DataPrism API Tokens and Export DataPrism Report Data. See Export reports and data.

Which permission lets a user continue after a PII warning?

PII Detection Bypass. It applies in warn mode, and PII Administrator includes it. See PII checks in chat.