Who can do what in DataPrism

Access to DataPrism comes from the permissions on a role, and from where a report or semantic model lives and who shared it with you. Use this page to choose a role's DataPrism permissions and to find out why someone can or cannot open, change, share or export an item.

Choose a bundle for each kind of user

A bundle is a ready-made set of permissions. Start with a bundle, then tick or untick individual permissions.

Bundle	Use it for	What it includes
DataPrism Viewer	Reading reports	View reports and DataPrism workspaces, and subscribe yourself to a report by email.
DataPrism Editor	Creating, editing, sharing and exporting your own reports	Everything in DataPrism Viewer, plus creating, editing and deleting your own reports, sharing them, and downloading report data.
DataPrism Administrator	Running DataPrism for the whole organisation	Every DataPrism permission.

The DataPrism tab of the role editor holds 3 high-level bundles like these, 18 standard bundles and 24 granular permissions.

Neither DataPrism Viewer nor DataPrism Editor includes Use DataPrism AI, Semantic Models Manager or DataPrism API Token Manager. An analyst who builds semantic models needs Semantic Models Manager added to DataPrism Editor. The custom visual bundles ship only with DataPrism Administrator, never with DataPrism Editor.

Turn on DataPrism permissions for a role

Open Admin in the sidebar, then select Roles. See Roles and permissions.
Open the role and select Permissions.
Select the DataPrism tab.
Tick the bundles and permissions the role needs.
Select Save changes. The button is available only after you change something.

The DataPrism tab has three tiers:

Tier	What you do	Default
High-Level	Tick a bundle to turn on everything it includes.	Off
Standard	Tick a permission for one task, such as Semantic Models Manager.	Off
Granular	Nothing. These rows are read-only. They turn on when a bundle or standard permission that includes them is ticked.	Off

Ticking a permission also ticks every bundle that contains it, once all of that bundle's parts are ticked. Unticking a permission unticks every bundle that contains it.

Standard permissions

Point to a permission in the editor to read its full description. The full list is in the permission reference. These are the ones you will use most:

Permission	What it allows
Reports Manager	Create, edit and delete your own reports.
DataPrism Reports Sharer	Share reports with specific users or roles.
DataPrism Reports Exporter	Download report data: chart downloads and xlsx or csv exports.
DataPrism API Token Manager	Create chart API tokens that export one chart through the API.
Semantic Models Manager	Create, edit and delete semantic models, including row-level security.
Others Personal DataPrism Workspaces Viewer	Browse every user's personal workspace and its contents, read-only.
DataPrism Subscriptions Manager	Subscribe to a report by email, and subscribe other users or roles.
Others DataPrism Subscriptions Viewer	See every user's report subscriptions.
DataPrism Custom Visual Author	Write custom visual code for report tiles, by hand or with the AI.

Other users' personal workspaces are reached only through View Everyone's Personal DataPrism Workspace, which Others Personal DataPrism Workspaces Viewer includes. The Others report permissions do not open them on their own.

The DataPrism permissions

The category holds 24 granular permissions in six families: reports, semantic models, workspaces, subscriptions, custom visuals and AI. The role editor shows them under the display names below, so ask for them by name.

Report permission	What it allows
View DataPrism Reports	Open and read reports you can reach.
Add DataPrism Report	Create reports and import report files.
Edit DataPrism Report	Change reports you reach through a workspace.
Delete DataPrism Report	Delete reports you own.
View Others DataPrism Reports	The view right for other people's reports.
Edit Others DataPrism Reports	The edit right for other people's reports.
Delete Others DataPrism Reports	The delete right for other people's reports.
Share DataPrism Reports	Share a report with users and roles, and create public links.
Export DataPrism Report Data	Download chart data, and export a report to PowerPoint or PDF.
Manage DataPrism API Tokens	Create chart tokens that let another system pull one chart.

Model and workspace permission	What it allows
View DataPrism Semantic Models	Open semantic models you can reach and read their structure.
Add DataPrism Semantic Model	Create models and import model files.
Edit DataPrism Semantic Model	Change a model: its BI tables, relationships, measures, folders and row-level security.
Delete DataPrism Semantic Model	Delete models.
View DataPrism Workspaces	See workspaces and what is inside them.
Manage DataPrism Workspaces	Create, rename and delete folders.
View Everyone's Personal DataPrism Workspace	Browse every user's personal workspace, read-only.

Subscription, visual and AI permission	What it allows
Subscribe to DataPrism Reports	Subscribe yourself to a report by email.
Subscribe Others to DataPrism Reports	Subscribe other users or roles.
View Everyone's DataPrism Subscriptions	See every user's report subscriptions.
Manage Everyone's DataPrism Subscriptions	Pause, reschedule or remove other people's subscriptions.
Author DataPrism Custom Visuals	Write custom visual code for report tiles, by hand or with the AI.
Publish Organization Visuals	Publish a custom visual to the organisation.
Disable DataPrism Custom Visuals	Turn a custom visual off for everyone.
Use DataPrism AI	Use the DataPrism AI features.

Use DataPrism AI

Use DataPrism AI turns on the AI inside DataPrism:

Model AI on a semantic model also needs permission to view and edit that model. See Model AI.
The measure AI, which writes or fixes a measure, needs permission to edit semantic models. See Measures.
Building a custom visual with AI also needs Author DataPrism Custom Visuals and edit access to the report. See Custom visuals and the visual library.

Important

The Granular tier cannot be ticked, so Use DataPrism AI comes only with the DataPrism Custom Visual Author bundle, or with the DataPrism Administrator bundle. The DataPrism Custom Visual Author bundle is Author DataPrism Custom Visuals plus Use DataPrism AI, so giving a role AI for models also lets it write custom visual code.

How DataPrism decides what you can reach

Your permissions set the outer limit. Where an item lives, and whether it was shared with you, decides what you can do with it. DataPrism checks the rungs in order: administrator, owner, a role workspace you hold, a share, a public link or chart token that acts for the report, another user's personal workspace, then no access.

Where the item lives	Who reaches it	What you can change
Your personal workspace	You	Your own reports and models, with the matching edit permission.
A role workspace	Everyone who holds that role	Reports and models, if you hold Edit DataPrism Report or Edit DataPrism Semantic Model.
Someone else's personal workspace	Users with View Everyone's Personal DataPrism Workspace	Nothing. The items open read-only.
A report shared with you	The users and roles it was shared with	What the share allows: Can view or Can edit. See Share a report.

A share covers one report. It never lets the person delete or move it, share it again, or create an API token for it.
Public links and chart tokens act for the whole report, so they need the owner level: you own the report, you can edit it in its role workspace, or you are an administrator. A report shared with you does not count.
Reading a report never needs access to the semantic model behind it. A report viewer without View DataPrism Semantic Models reads a trimmed model: reportable columns only, with measure expressions withheld. See Semantic models and BI tables.
Writing anything inside a model, from one measure to the diagram to row-level security, needs Edit DataPrism Semantic Model for that model. The same right covers creating, editing, disabling and removing relationships, saving table positions, re-checking red measures and replacing a BI table's source. On a model that has never been saved, these actions do not appear at all. See Relationships and the core table.
Bulk deletes ask for no extra permission: each item is checked with the gate a single delete would use, and a refusal names only the items you could not delete.

An item you can open but not change shows a View only marker; point to it to read View only: you can open it but not edit it.

Semantic models cannot be shared. A user reaches a semantic model only through its workspace. For more on workspaces, see Workspaces, folders and the home page.

Actions you cannot use are hidden

DataPrism hides what you cannot do instead of showing it greyed out:

The New menu in the workspaces panel offers only what you may create. With nothing you may create, the menu shows no options, and the home header buttons are hidden completely.
The item menu hides model actions you cannot use: Make a copy and Export .semanticModel... need both the model create and model edit rights, and Subscribe to email is left out unless you may subscribe.
A keyboard shortcut can never reach an action the menu would not offer.

While you view as another user

Impersonation runs the session as the viewed user, under their access. A few actions are refused while it lasts:

Action	While viewing as another user
Reading reports and models	Works, as the viewed user sees them.
Running SQL in the Editor	Refused: `SQL execution is disabled while impersonating another user; exit the view to run queries`
Downloads from the Editor	Refused.
Writing custom visual code	Refused: `Custom visual code cannot be authored while impersonating another user.`

Your own administrator rights do not carry into the view. Exit the view to use the refused actions. See Impersonate a user and Editor.

Refused actions and their messages

A refused DataPrism action shows a short message. The common ones:

Message	What it means
`You do not have permission to perform this action`	The default refusal when no DataPrism permission covers the action.
`You do not have access to this workspace.`	The workspace is out of your reach.
`You do not hold the role that owns this workspace.`	The workspace belongs to a role you do not hold.
`This is another user personal workspace.`	Personal workspaces stay personal without View Everyone's Personal DataPrism Workspace.
`You do not have access to this report.`	The report is out of your reach.
`You do not have access to this semantic model.`	The model is out of your reach.
`You can view semantic models in other users personal workspaces, but not edit them.`	Browsing another person's workspace stays read-only.
`You do not have permission to edit this semantic model.`	The model edit right is missing for that model.
`A report shared with you cannot be deleted. Only the workspace it lives in can do that.`	The same sentence appears for moving to another workspace, sharing and exporting through API tokens. A share never covers these.
`Only a DataPrism Administrator can disable a custom visual.`	Disabling a custom visual needs the administrator bundle.

Limits and edge cases

None of the DataPrism permissions is on by default.
DataPrism API Token Manager is only in the DataPrism Administrator bundle. A chart API token keeps working until it is revoked, even after its creator loses access.
The DataPrism item appears in the sidebar only when a user can view reports or semantic models.
Semantic models have no sharing and no Others permissions.
Deleting a role that owns semantic models shows a warning. The warning names the models and says that they will stop working.
Names run up to 120 characters, and feed search needs at least 2 characters.
The home feed shows up to 10 cards, and a local list of visited items keeps the newest 200 per user.
The model change history keeps the newest 200 events.
A public link label is up to 200 characters, and a custom visual's saved state is capped at 16 KiB. See Custom visuals and the visual library.

Questions, answered

What should a report reader get?

Give them DataPrism Viewer. They can open their own reports, reports shared with them and reports in the role workspaces they hold, and they can subscribe themselves to a report by email. They cannot create reports and they cannot download report data.

What does someone who builds semantic models need?

DataPrism Editor and Semantic Models Manager. For Model AI and the measure AI, add Use DataPrism AI, which comes with DataPrism Custom Visual Author.

Can an Editor change other people's reports?

Yes, in the role workspaces they hold, if they have Edit DataPrism Report, and in reports shared with them as Can edit. Reports in someone else's personal workspace open read-only.

Who can create chart API tokens?

Users who hold Manage DataPrism API Tokens and Export DataPrism Report Data, and who administer the report: they own it, can edit it in its role workspace, or are an administrator. Only the DataPrism Administrator bundle includes DataPrism API Token Manager, which gives both. See Export reports and data.

Why can a user not download report data?

They do not hold Export DataPrism Report Data, which covers chart downloads and xlsx or csv exports. DataPrism Editor includes it. DataPrism Viewer does not.

Who can see everyone's subscriptions?

Users with View Everyone's DataPrism Subscriptions, which Others DataPrism Subscriptions Viewer includes. To pause, reschedule or remove other people's subscriptions, they also need Manage Everyone's DataPrism Subscriptions. See Email subscriptions.

How do I let someone browse other people's personal workspaces?

Give them Others Personal DataPrism Workspaces Viewer. They can browse every user's personal workspace read-only, and they cannot change anything in it.

Do administrators need every DataPrism permission?

No. The built-in administrator role bypasses the DataPrism permission gates, so an administrator can do everything in DataPrism without holding every permission. Administrators also count as members of every model's main security group, so row-level security never filters them. See Row-level security.

Why can I open something but not change it?

You have viewing rights on the item, not editing rights. You may hold View DataPrism Reports but not Edit DataPrism Report, or View DataPrism Semantic Models but not Edit DataPrism Semantic Model, or you may reach the item through a Can view share or another person's workspace. The item shows View only when you can open it but not edit it.

Why do some options not appear instead of showing as disabled?

DataPrism hides what you cannot use. When a create option, a menu action or a button is missing, the right it performs is missing from your roles too. A keyboard shortcut cannot reach an action the menu would not offer.

What can I not do while viewing as another user?

The Editor does not run SQL, downloads from the Editor are refused, and custom visual code cannot be authored. Reading reports and models continues as the viewed user sees them, and your administrator rights do not carry into the view. Exit the view to use the refused actions. See Impersonate a user.