Skip to main content
A role is a named set of permissions. Users, groups, and service accounts are assigned one or more roles; the union of those permissions defines what they can do. For the underlying permission grammar, see Control Plane vs Compute Plane permissions.

​
Built-in roles

Every workspace ships with three built-in roles. Most organizations don’t need anything else.

​
What each built-in role can do

The complete, exhaustive permission list lives in the Permissions matrix reference.

​
Assigning roles

From the Console (Control Plane for org scope, or a workspace for compute scope):
  1. Open Access Control → Users (or Service Accounts, or Groups).
  2. Select the identity.
  3. Click Add role.
  4. Pick a role and a scope - workspace-wide, or limited to specific catalogs or clusters.
  5. Save.
A user can hold different roles in different workspaces - for example, Admin in dev and Viewer in prod. Assigning roles to a group and managing membership is usually cleaner than per-user assignment.

​
Group-to-role mapping via SSO

If you use SSO, you can map IdP groups to e6data roles so users get the right role automatically on sign-in - no per-user assignment.

​
See also

Last modified on September 29, 2026