RUNNING

Permissions

What each of the five roles may do in the RunningLake control plane. This page is built from the same file the running system enforces, so it cannot describe a grant the product does not hold.

These are not data permissions

Nothing in this table grants access to a row or a column of a table. Whether someone may SELECT a column is decided by the catalog’s policy, which is a separate system with its own audit trail. Being an owner does not grant data access.

One exception, named rather than implied. volume.preview lets an owner, an admin or an engineer read the first 256 KiB of one uploaded file that is not yet in any table, so that a bad file is caught before it is promoted. There is no catalog policy on that path, because there is no table yet. A restricted layer’s grants still apply: a layer whose grants do not name you hides its volumes from you. Promoting a file copies it, so the uploaded copy stays readable through this permission after its rows are in a table.

One more thing the table cannot show. It lists what a role may do, and certification.set reads owner and admin. The steward or the owner of an asset by assignment may also certify it, in a signed-in session. In the same way metadata.edit reads owner, admin and engineer, and the steward or the owner of an asset by assignment may also write its description, in a signed-in session. In the same way glossary.approve reads owner and admin, and the steward of a term’s domain by assignment may also approve a version, in a signed-in session. An assignment is not a role, and an API token is judged by its own role alone. Stewardship says who may do what.

The matrix

Every action in the file, in the file’s own order. Each action’s name is its own link target.
Action	Owner	Admin	Engineer	Analyst	Viewer	Fresh sign-in	Enforced
`org.billing.manage`	Yes	No	No	No	No	No	Declared only
`org.tier.change`	Yes	No	No	No	No	No	Declared only
`org.delete`	Yes	No	No	No	No	Yes	Declared only
`org.transfer`	Yes	No	No	No	No	Yes	Declared only
`org.idp.manage`	Yes	No	No	No	No	Yes	Yes
`org.idp.join.widen`	Yes	No	No	No	No	Yes	Yes
`org.idp.join.narrow`	Yes	Yes	No	No	No	No	Yes
`org.member.manage`	Yes	Yes	No	No	No	No	Yes
`org.member.promote`	Yes	No	No	No	No	Yes	Yes
`org.member.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`org.notice.read`	Yes	No	No	No	No	No	Yes
`org.adhocengine.manage`	Yes	Yes	No	No	No	Yes	Yes
`org.adhocengine.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`org.adhocengine.review`	Yes	Yes	No	No	No	No	Yes
`org.settingsproject.read`	Yes	Yes	No	No	No	No	Yes
`org.settingsproject.set`	Yes	No	No	No	No	Yes	Yes
`project.create`	Yes	Yes	No	No	No	No	Yes
`project.delete`	Yes	Yes	No	No	No	Yes	Yes
`project.member.manage`	Yes	Yes	No	No	No	No	Declared only
`project.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`project.adhocsql.manage`	Yes	Yes	No	No	No	No	Declared only
`env.create`	Yes	Yes	No	No	No	No	Yes
`env.delete`	Yes	Yes	No	No	No	Yes	Declared only
`env.spendcap.set`	Yes	Yes	No	No	No	Yes	Yes
`env.changepolicy.set`	Yes	Yes	No	No	No	No	Yes
`env.plane.set`	Yes	Yes	No	No	No	No	Yes
`env.rename`	Yes	Yes	No	No	No	No	Yes
`quota.set`	Yes	Yes	No	No	No	No	Declared only
`dataplane.create`	Yes	Yes	No	No	No	Yes	Yes
`dataplane.delete`	Yes	Yes	No	No	No	Yes	Yes
`dataplane.read`	Yes	Yes	Yes	No	No	No	Yes
`dataplane.upgrade`	Yes	Yes	No	No	No	No	Declared only
`dataplane.supportsession.grant`	Yes	Yes	No	No	No	Yes	Yes
`dataplane.supportsession.end`	Yes	Yes	No	No	No	No	Yes
`dataplane.supportsession.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`dataplane.preflight.record`	Yes	Yes	Yes	No	No	No	Yes
`config.propose`	Yes	Yes	Yes	No	No	No	Yes
`config.apply.nonprod`	Yes	Yes	Yes	No	No	No	Yes
`config.apply.prod`	Yes	Yes	No	No	No	No	Yes
`config.approve`	Yes	Yes	No	No	No	No	Yes
`config.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`config.withdraw`	Yes	Yes	Yes	No	No	No	Yes
`repo.connect`	Yes	Yes	No	No	No	Yes	Yes
`source.connect`	Yes	Yes	Yes	No	No	No	Yes
`source.sync`	Yes	Yes	Yes	No	No	No	Yes
`source.slot.drop`	Yes	Yes	No	No	No	Yes	Declared only
`secret.write`	Yes	Yes	Yes	No	No	No	Declared only
`migration.analyse`	Yes	Yes	Yes	No	No	No	Yes
`migration.export`	Yes	Yes	Yes	No	No	No	Yes
`migration.manage`	Yes	Yes	Yes	No	No	No	Yes
`migration.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`volume.write`	Yes	Yes	Yes	No	No	No	Yes
`volume.preview`	Yes	Yes	Yes	No	No	No	Yes
`secret.read`	No	No	No	No	No	No	Declared only
`secret.reads.list`	Yes	Yes	Yes	No	No	No	Yes
`key.manage`	Yes	Yes	No	No	No	Yes	Yes
`storagerule.replay`	Yes	Yes	Yes	No	No	No	Declared only
`storagerule.backfill`	Yes	Yes	Yes	No	No	No	Declared only
`storagerule.breaker.reset`	Yes	Yes	No	No	No	Yes	Declared only
`pipeline.run`	Yes	Yes	Yes	No	No	No	Yes
`pipeline.backfill`	Yes	Yes	Yes	No	No	No	Declared only
`run.cancel`	Yes	Yes	Yes	No	No	No	Yes
`run.hold`	Yes	Yes	Yes	No	No	No	Yes
`run.hold.release`	Yes	Yes	Yes	No	No	Yes	Yes
`run.hold.manage`	Yes	Yes	No	No	No	No	Yes
`run.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`pipeline.file.read`	Yes	Yes	Yes	No	No	No	Yes
`run.logs.delete`	Yes	Yes	No	No	No	Yes	Declared only
`run.parameters.erase`	Yes	Yes	No	No	No	Yes	Yes
`python.execute`	Yes	Yes	Yes	No	No	No	Yes
`authoring.draft`	Yes	Yes	Yes	Yes	No	No	Yes
`design.approve`	Yes	Yes	Yes	No	No	No	Yes
`query.execute`	Yes	Yes	Yes	Yes	No	No	Yes
`query.save`	Yes	Yes	Yes	Yes	No	No	Yes
`query.share`	Yes	Yes	Yes	Yes	No	No	Yes
`sql.credential.create`	Yes	Yes	Yes	Yes	No	No	Yes
`sql.credential.manage`	Yes	Yes	No	No	No	No	Yes
`query.cancelothers`	Yes	Yes	No	No	No	No	Yes
`query.removeothers`	Yes	Yes	No	No	No	No	Yes
`ai.ask`	Yes	Yes	Yes	Yes	No	No	Declared only
`board.edit`	Yes	Yes	No	No	No	No	Declared only
`catalog.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`lineage.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`table.drop`	Yes	Yes	Yes	No	No	Yes	Declared only
`classification.set`	Yes	Yes	Yes	No	No	No	Yes
`routing.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`routing.org.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`routing.shadow.set`	Yes	Yes	No	No	No	No	Yes
`policy.propose`	Yes	Yes	Yes	No	No	No	Yes
`policy.approve`	Yes	Yes	No	No	No	No	Yes
`cost.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`cost.export`	Yes	Yes	Yes	No	No	No	Yes
`audit.read`	Yes	Yes	No	No	No	No	Yes
`audit.export`	Yes	Yes	No	No	No	No	Yes
`audit.delivery.read`	Yes	Yes	No	No	No	No	Yes
`audit.delivery.manage`	Yes	Yes	No	No	No	No	Yes
`audit.delivery.enable`	Yes	Yes	No	No	No	Yes	Yes
`org.agreement.read`	Yes	Yes	No	No	No	No	Declared only
`org.agreement.accept`	Yes	Yes	No	No	No	Yes	Declared only
`org.agreement.request`	Yes	Yes	No	No	No	No	Declared only
`org.subprocessor.read`	Yes	Yes	Yes	Yes	Yes	No	Declared only
`org.incident.read`	Yes	Yes	Yes	Yes	Yes	No	Yes
`metadata.generate`	Yes	Yes	Yes	No	No	No	Declared only
`metadata.edit`	Yes	Yes	Yes	No	No	No	Yes
`metadata.review`	Yes	Yes	No	No	No	No	Declared only
`glossary.propose`	Yes	Yes	Yes	Yes	No	No	Yes
`glossary.approve`	Yes	Yes	No	No	No	No	Yes
`stewardship.assign`	Yes	Yes	No	No	No	No	Yes
`certification.set`	Yes	Yes	No	No	No	No	Yes
`access.request`	Yes	Yes	Yes	Yes	Yes	No	Declared only
`agent.autonomy.set`	Yes	Yes	No	No	No	Yes	Declared only
`agent.autonomy.revoke`	Yes	Yes	No	No	No	No	Declared only
`model.calls.read`	Yes	Yes	Yes	No	No	No	Yes
`model.prompt.read`	Yes	Yes	No	No	No	No	Declared only
`model.prompt.store`	Yes	Yes	No	No	No	Yes	Yes
`model.budget.set`	Yes	Yes	No	No	No	No	Yes
`model.release.promote`	Yes	Yes	No	No	No	Yes	Declared only
`model.endpoint.test`	Yes	Yes	Yes	No	No	No	Declared only
`ai.policy.set`	Yes	Yes	No	No	No	No	Yes
`access.signal.acknowledge`	Yes	Yes	No	No	No	No	Declared only
`model.provider.manage`	Yes	Yes	No	No	No	Yes	Yes
`token.create.project`	Yes	Yes	Yes	No	No	No	Yes
`token.create.org`	Yes	Yes	No	No	No	No	Yes
`token.read`	Yes	Yes	Yes	No	No	No	Yes
`token.revoke`	Yes	Yes	Yes	No	No	No	Yes
`principal.read`	Yes	Yes	Yes	No	No	No	Yes
`principal.manage`	Yes	Yes	No	No	No	Yes	Yes
`principal.credential.create`	Yes	Yes	No	No	No	Yes	Yes
`principal.revoke`	Yes	Yes	Yes	No	No	No	Yes
`principal.webhook.test`	Yes	Yes	Yes	No	No	No	Yes

Declared only means the action is recorded in the file and nothing in the product checks it yet. Read it as a decision recorded, not a control in force.

No role holds secret.read. That is deliberate, not an oversight.

An action marked Fresh sign-in requires that you confirmed it is you within the last five minutes, through your identity provider. Signing in is not a confirmation: right after you sign in, the first of these actions asks you to confirm once, and your session may then take any of them for five minutes. An API token never does, because a token carries no sign-in time, so these actions need a person in a browser session.

Roles, today

Roles are assigned to a person across the whole organisation. A role on a single project that overrides the organisation’s is part of the model, and nothing in the product assigns one yet, so today everyone holds the same role in every project. An environment is not a scope for a role: whether it is production, its change policy and whether it needs approval limit what any role may do there.