Roles and permissions
The built-in Admin, Manager, and Viewer roles, what each can do, and how to design custom roles in e6data.
A role is a named set of permissions. Users, groups, and service accounts are assigned one or more roles; the union of those permissions defines what they can do. For the underlying permission grammar, see Control Plane vs Compute Plane permissions.
Built-in roles
Every workspace ships with three built-in roles. Most organizations don't need anything else.
Admin
Organization owner, platform team
Full access to all workspace operations, including settings, access control, and version upgrades.
Manager
Data engineers, BI leads
Create and edit clusters and catalogs, run queries, and view the whole workspace - but not manage users, roles, or settings.
Viewer
Analysts, dashboard consumers
Run queries on assigned clusters and catalogs; no edit access.
What each built-in role can do
Workspace
View workspace
✅
✅
✅
Edit workspace settings
✅
-
-
Suspend / resume workspace
✅
✅
-
Delete workspace
✅
-
-
Catalogs
View catalogs
✅
✅
✅
Create / edit / refresh / delete catalog
✅
✅
-
Clusters
View clusters
✅
✅
✅
Create / edit / suspend / delete cluster
✅
✅
-
Queries
Run queries, view own history
✅
✅
✅
View all query history, cancel any query
✅
✅
-
Access control
View users and roles
✅
✅
-
Invite/remove users, manage roles, manage service accounts
✅
-
-
Settings
Configure SSO, trigger version upgrades
✅
-
-
Configure observability
✅
✅
-
The complete, exhaustive permission list lives in the Permissions matrix reference.
Assigning roles
From the Console (Control Plane for org scope, or a workspace for compute scope):
Open Access Control → Users (or Service Accounts, or Groups).
Select the identity.
Click Add role.
Pick a role and a scope - workspace-wide, or limited to specific catalogs or clusters.
Save.
A user can hold different roles in different workspaces - for example, Admin in dev and Viewer in prod. Assigning roles to a group and managing membership is usually cleaner than per-user assignment.
Group-to-role mapping via SSO
If you use SSO, you can map IdP groups to e6data roles so users get the right role automatically on sign-in - no per-user assignment.
See also
Last updated
Was this helpful?