Who can do what in the Lake

Access to the Lake is set with permissions on roles. Use this page to decide which permissions a person needs to view, build, run and delete Lake objects, and to understand what they see when a permission is missing.

The Lake object permissions

Four permissions control the datasources and tables in the Lake.

Permission	What it lets a user do
View Lake Objects	See the Lake, its datasources, tables and saved connections.
Add/Modify Lake Objects	Create and edit datasources, import tables, configure and deploy them, batch edit tables, change connector secrets and approve the hosts of an API recipe. Includes View Lake Objects.
Execute/Abort Lake Objects	Synchronize a table, abort a running load, stop a datasource's sync, run Sync Schema on a datasource, and run a live connection check or discover the streams of a Connect Any API datasource.
Remove Lake Objects	Delete Lake tables and datasources.

Without View Lake Objects, Lake is not in the sidebar and the Lake page does not open.

On a Connect Any API connector, Test connection and Save and sync run under Execute/Abort Lake Objects too. A user with Add/Modify Lake Objects and no execute permission can still save the connector, including approving a new host, but cannot test or sync it. See Connect any API.

The Lake workflow permissions

Five permissions control Lake workflows, including the Workflows tab in the Lake.

Permission	What it lets a user do
View Lake Workflow Objects	See Lake workflow definitions and details.
Execute Lake Workflow Objects	Run and abort Lake workflows.
Add Lake Workflows	Create Lake workflows.
Modify Lake Workflows	Edit Lake workflows.
Remove Lake Workflows	Delete Lake workflows.

Presets

Presets bundle permissions so you do not have to pick each one. The full list is in the Permission reference.

Preset	Lake permissions it includes
Lake Viewer	View Lake Objects.
Lake Administrator	All four Lake object permissions, View Lake Workflow Objects, Execute Lake Workflow Objects and Modify Lake Workflows. It does not include Add Lake Workflows or Remove Lake Workflows.
Data Layer Viewer (High-Level)	Lake Viewer, plus the viewer presets for Warehouse and WriteBack and Lineage Viewer.
Data Layer Administrator (High-Level)	Lake Administrator, plus the administrator presets for Warehouse and WriteBack and Lineage Viewer.

How the checks work

Most Lake actions pass two checks: the permission on your role, and a second check on the object the action touches.

Importing database structure into the Lake runs both checks before anything is imported. See Import tables.
Editing a table's settings is gated by Add/Modify Lake Objects alone. Warehouse and WriteBack modify permissions do not open a Lake table's settings.

Sources and destinations

Every datasource has a direction: a source on the Lake side, or a destination on the WriteBack side. Your permissions apply per direction.

Creating a datasource follows the direction: a Lake modifier cannot create a WriteBack destination, and a WriteBack modifier cannot create a Lake source.
Saving and folder moves follow the direction too. A WriteBack modifier cannot save a Lake source or move it into WriteBack, and a Lake modifier cannot save a WriteBack destination.
Duplicating across directions is refused: a Lake modifier cannot duplicate a source into WriteBack, and a WriteBack modifier cannot duplicate a Lake source.
The direction is fixed after creation. A save that changes it is refused with The connection direction of a data source cannot be changed.
Reading a datasource's connection settings needs the view permission of its direction: View Lake Objects for a source, View WriteBack Objects for a destination. The other direction's view permission is refused.

To create a destination for sending data out, see Add and manage destinations.

What a viewer can and cannot do

A viewer reads a datasource's settings, but a stored password is never filled in. The form shows Stored password with a Replace option. To change the value, select Replace and enter a new one.
Duplicating needs Add/Modify Lake Objects; a viewer cannot duplicate a datasource. The copy keeps the connection's stored password, but stored secrets are not copied, so enter their values again on the copy. See Connect Anything.
A user with a view permission can open a connector's secret vault and see the names of its stored secrets, but cannot set or delete them. The vault tells them they have view-only access.
Uploading files to a file source and fetching preview samples need Add/Modify Lake Objects. A remote connection test needs at least View Lake Objects. See Connect files.
The View Source search on a Lake datasource needs a view permission for that layer: View Lake Objects. A role with only View WriteBack Objects is refused. See Import tables.

Give someone Lake access

Open Admin in the sidebar, then open Roles.
Open the menu of the role and choose Edit Permissions.
Turn on the Lake permissions the role needs, or a preset that includes them, then click Save changes.
To give the role to people, open the role's details, choose Users, add the people and save.

For roles, presets and table access across DataMind OS, see How access works and Roles and permissions.

What users see without a permission

Workflows tab. The Workflows tab in the Lake appears only with View Lake Workflow Objects. If a user has the tab open when they lose the permission, the Lake returns to its datasources view.
Most actions stay visible. The Lake shows its buttons and menu items to everyone who can open it. When a user runs an action they are not allowed to run, the request is refused with this message: Access denied. Required permission(s): followed by the permission names. For Synchronize, the message names Execute/Abort Lake Objects or Execute/Abort WriteBack Objects; either one allows the action. Stop Sync runs under the same gate, and stopping a sync that is not running answers Data source "…" is not currently syncing. See Lake troubleshooting for other messages.
Secrets and History. A connector's Secrets section and its configuration History appear only with View Lake Objects.

Note

The Lake permissions do not cover Warehouse or WriteBack, which have their own permissions. See Warehouse permissions and row-level security.

Questions, answered

A colleague can see tables but cannot Synchronize. What do they need?

They need Execute/Abort Lake Objects. Without it, the Synchronize request is refused with an access message that names Execute/Abort Lake Objects or Execute/Abort WriteBack Objects; either one allows the action.

Who can delete a datasource?

Users with Remove Lake Objects can delete datasources and tables. Users without it can see the Delete action, but the request is refused.

Can someone build connectors but not run them?

Yes. Give them Add/Modify Lake Objects without Execute/Abort Lake Objects. They can create, edit and save connections, but they cannot synchronize tables, stop a sync, run Sync Schema or run a live check on a Connect Any API datasource.

Do I need View Lake Objects if I already have Add/Modify Lake Objects?

No. Add/Modify Lake Objects already includes viewing.

Why can't I see the Workflows tab in the Lake?

You need View Lake Workflow Objects. Ask your administrator to add it to your role. Without it, the header shows only Dashboard, Relationship Diagram and Add datasource. For what the tab shows, see Workflows in the Lake; for the permissions behind each workflow action, see Workflow permissions.

What does "Access denied. Required permission(s): …" mean?

Your role does not have the permission named in the message. If the message names two permissions joined by OR, either one is enough. Ask your administrator to add one of them to your role.

Do Warehouse permissions give access to the Lake?

Not on their own. The Warehouse Viewer preset does not include Lake permissions. The Warehouse Administrator and WriteBack Administrator presets do include View Lake Objects, so those users can see the Lake.

Can a viewer read stored passwords?

No. Stored passwords and keys are not shown to anyone in the product. A user with View Lake Objects can see the names of a connector's stored secrets, but not their values.

Who can approve the hosts of an API recipe?

Users with Add/Modify Lake Objects. Approving hosts is part of building a recipe. A user with Add/Modify Lake Objects but no execute permission can still save the connector by approving its hosts, but Test connection and Save and sync need Execute/Abort Lake Objects. See Connect any API.

Can a Lake Administrator create or delete Lake workflows?

No. The Lake Administrator preset can view, run and edit Lake workflows, but it does not include Add Lake Workflows or Remove Lake Workflows. Grant those two permissions separately.

Why can't a colleague with WriteBack access save a Lake source?

Permissions follow the datasource's direction. A user with WriteBack modify permissions cannot save a Lake source, move it into WriteBack or duplicate it across, and a Lake modifier cannot save a WriteBack destination. Saving a Lake source needs Add/Modify Lake Objects. The direction is fixed after creation, so a save that changes it is refused.

Who can upload files, test a connection or search a source?

Uploading files and fetching preview samples need Add/Modify Lake Objects. A remote connection test needs at least View Lake Objects. The View Source search on a Lake datasource needs View Lake Objects; a role with only View WriteBack Objects is refused.