A role is a named set of permissions and table access that you give to users. Use this page to create roles, change what they allow, and retire them safely. Table access and membership have their own page: Manage a role's tables and users.
The list shows each role's Role, Description, Status and Users. Every column sorts and filters; the filter menu has a Reset button, and an empty value shows as (Empty). Click a role to open its details on the right; clicking the selected row again closes the panel. DataMind OS remembers the last role you opened in this browser, and reopens it when you return.
The list also offers a card view, where each role shows Lake: N, DWH: N and Users: N badges.
The row menu offers Edit Role, Edit Permissions, Manage Tables and Delete Role. You see only the actions your permissions allow, and Delete Role is hidden for the built-in Admin role.
The toolbar has Add Role (hover shows Add new role), which appears only if you can create roles, and Audit, which downloads the permission audit as an Excel file. See Permission audit workbook.
You see the Roles tab only if your permissions let you view roles, for example with Roles Viewer. See Permission reference.
Register stays greyed out until you change the form. An address ending in ?modal=create opens the create form directly.
Registering a role also creates its databases in the data layer: <role>_Lake, <role>_WH and <role>_Temp, and the tokenised PII_ mirrors of its Lake and Warehouse databases. The role's members use them in the Editor and Database Explorer; see SQL dialect and data scope.
Names may use English letters and underscores only, so a name with a hyphen or a digit is refused with "The name field can only contain English letters and underscores". Role names are unique without regard to capitals: a name already in use is refused with "The role with the name X already exists", and a reserved name with "The name is reserved, please choose different one". The name cannot be changed after the role is created.
The panel's permissions summary has its own Search permissions... box. An empty list reads "No permissions assigned" with "Nothing has been granted yet.", and a search with no matches reads "No permissions match your search".
To manage roles, a person needs Roles Administrator, or the Standard permissions it bundles, such as Add/Remove Roles, Edit Role Permissions, Edit Role Table Permissions and Manage Role Membership. Roles Viewer gives view-only access. Each part of a role has its own permission, for example Edit Role Icon & Color for the icon and colour and Activate/Deactivate Roles for its status. Holding any one of them unlocks the general Edit Role action, and Manage Role Membership alone covers every action on a role.
For what each permission allows, see Permission reference. For how presets switch on and off in the editor, see How access works.
A role also decides which Lake and Warehouse tables its members can use, and who holds it. Both editors live on their own page: Manage a role's tables and users. Reach them from Manage Tables in the row menu, or from the role panel's Tables and Assigned users sections. Table access decides which tables a member can use in the Editor; see SQL dialect and data scope.
To deactivate or activate a role:
A deactivated role stops granting access until you activate it again. Users keep the access of their other active roles. If the change fails, DataMind OS reports "Failed to update role status".
To delete a role:
The dialog checks the DataPrism semantic models the role owns. If there are any, it warns: "{count} semantic model(s) are owned by this role and will stop working: {names}". If the check cannot run, it reads "Dependants could not be determined because the check failed. Deleting this role may be unsafe."
Deleting a role is permanent. DataMind OS also deletes the Minds that the role owns, and removes the role from the other Minds and tables that used it; its table access and row-level security are cleared at the same time, and its databases in the data layer are deleted with it.
| Setting | What it does | Default |
|---|---|---|
| Role Name | Identifies the role. | Required. 2 to 50 characters. Fixed after creation. |
| Description | Says what the role is for. | Optional. Up to 150 characters. |
| Active | Turns the role's access on or off. | Off for a new role. |
| Role Color | Colours the role. | Chosen from the colour swatches. |
| Role Icon | Icon shown with the role. | Shield. |
Common refusal messages are explained in Administration troubleshooting.
No. The name is fixed when the role is created. Create a new role with the right name, move its users to it, then delete the old role.
The role still has users, or it is the SSO default role. Remove everyone in its Users section, or set a different default role in Single sign-on (SSO) first.
The role owns those DataPrism semantic models, so they stop working once it is deleted. Check them first in Concepts and glossary.
Deleting a role deletes the Minds that the role owns, and removes the role from the other Minds and tables that used it. Its table access and row-level security are cleared at the same time. Review Minds permissions before you delete.
The role stops granting its permissions to everyone who holds it. Users who have other active roles keep that access. A user whose roles are all inactive cannot sign in until you activate one of them.
The name starts with a prefix that DataMind OS reserves for its own use. Choose a different name.
No. Role names are compared without regard to capitals, so "Finance" and "finance" count as the same name.
New roles start with Active off, so they grant nothing until you switch them on. Open the role, click Activate role, and confirm.
The role was removed while you had it open, or you may not have access to it. The panel shows "Role not found" with "This role may have been removed or you may not have access." Refresh the list and open another role.
You do not need to set it up, and you cannot change its permissions. The built-in Admin role always has every permission, so its permissions show as granted and locked. It cannot be deactivated or deleted.