Skip to content

Admin roles

An admin account holds one or more roles. owner and admin may do everything; the others open parts of the console. A request is allowed when the account holds any role the route’s rule names.

Role Meaning
owner Everything, including admin accounts. The first admin is an owner.
admin Everything, like owner.
security_admin Identities, keys and grants; any mutation without a narrower rule.
source_admin Data sources, connectors, source roles, catalog and ingestion.
policy_admin Policy rules.
approval_reviewer Reviewing queued writes: approve and reject.
auditor Read-only access to the console, audit and usage.
Path prefix Roles besides owner and admin
/ approval_reviewer, auditor, policy_admin, security_admin, source_admin
/openapi.json security_admin
/docs security_admin
/redoc security_admin
/dashboard/overview approval_reviewer, auditor, policy_admin, security_admin, source_admin
/dashboard/source-wizard security_admin, source_admin
/dashboard/data-sources security_admin, source_admin
/dashboard/connectors security_admin, source_admin
/dashboard/access-control security_admin
/dashboard/policies policy_admin, security_admin
/dashboard/policy-analytics policy_admin, security_admin
/dashboard/audit-costs auditor, security_admin
/dashboard/audit-costs/export.csv auditor, security_admin
/dashboard/write-safety approval_reviewer, security_admin
/dashboard/proxy auditor, security_admin
/dashboard/proxy-monitor auditor, security_admin
/dashboard/ingestion security_admin, source_admin
/dashboard/workers security_admin, source_admin
/dashboard/discovery auditor, security_admin, source_admin
/dashboard/catalog auditor, policy_admin, security_admin, source_admin
/dashboard/categories auditor, security_admin, source_admin
/dashboard/entities auditor, security_admin, source_admin
/dashboard/alerts security_admin
/api/data-sources security_admin, source_admin
/api/connectors security_admin, source_admin
/api/identities security_admin
/api/source-roles security_admin
/api/policies policy_admin, security_admin
/api/approvals approval_reviewer, security_admin
/api/ingestion security_admin, source_admin
/api/catalog auditor, policy_admin, security_admin, source_admin

Rules for POST, PUT, PATCH and DELETE. A change under /dashboard or /api with no rule below needs security_admin.

Path prefix Roles besides owner and admin
/dashboard/source-wizard security_admin, source_admin
/dashboard/data-sources security_admin, source_admin
/api/data-sources security_admin, source_admin
/dashboard/connectors security_admin, source_admin
/api/connectors security_admin, source_admin
/dashboard/discovery/rescan security_admin, source_admin
/dashboard/policies policy_admin, security_admin
/api/policies policy_admin, security_admin
/dashboard/access-control security_admin
/api/identities security_admin
/api/source-roles security_admin
/api/admin-auth/oidc security_admin
/api/approvals approval_reviewer, security_admin
/dashboard/write-safety approval_reviewer, security_admin
/dashboard/alerts security_admin
/api/alerts security_admin
/dashboard/ingestion security_admin, source_admin
/api/ingestion security_admin, source_admin