---
url: 'https://docs.codatum.com/permissions/resources/connection.md'
description: Connection permissions based on access level and resource role
---

# Connection permissions

Whether an operation on a connection is allowed is determined by the [workspace role](../../workspace/administration/user#workspace-roles), plus the access level and resource role.

* **[Access level](#access-level)** determines who can use the connection.
* **Resource role** determines which operations are allowed within that scope.

For example, for a connection with an **access level of Protected**, only users and groups granted a permission can use the connection. Within that group, a **Connection User** is allowed to run SQL and view the results, while a **Connection Viewer** is only allowed to view the results.

For a feature overview, see [Connection](../../features/connection/overview).

## Access level {#access-level}

| Access level {.nowrap} | Description |
| --- | --- |
| Workspace | Members in the workspace can access it according to their workspace role |
| Protected | Only users and groups granted a resource role can access it. The Workspace Owner can edit the connection's permissions |
| Private | Only users and groups granted a resource role can access it. Even the Workspace Owner can't edit the connection's permissions |

::: tip
The Protected and Private access levels are an **optional feature**. Depending on your contract, they might not be available.
:::

## Resource role

| Role {.nowrap} | Summary |
| --- | --- |
| Connection Owner | Can edit and delete the connection, and change its permission settings |
| Connection User | Can run SQL, view the results and tables, and publish related reports |
| Connection Viewer | Can view the results and tables |

Up to 3 Connection Owners can be added ([Fixed limits and constraints](../../reference/limits#fixed-limits)). The **demo connection** is an exception: Codatum manages it, so you can't edit or delete the general settings, access level and permissions, or sync targets. You also can't add or remove individual Connection Owners.

## Operations and required roles

"X or higher" in the tables means that role and any higher role can perform the operation. Changing a connection's permission settings includes changing the access level and granting or changing resource roles.

### Access level: Workspace

No individual permission grant is needed for members. Whether an operation is allowed is mainly determined by the workspace role.

| Operation | Required role |
| --- | --- |
| Creating a connection | Workspace Editor or higher |
| Listing connection names | Workspace Viewer or higher |
| Editing and deleting a connection | Workspace Owner, or Connection Owner |
| Changing a connection's permission settings | Workspace Owner, or Connection Owner |
| Running SQL on a connection / downloading execution results | Workspace Editor or higher |
| Getting a connection's SQL execution results and table information | Workspace Viewer or higher |

### Access level: Protected

Only users and groups granted a resource role can use this connection. The Workspace Owner can change the connection's permission settings.

| Operation | Required role |
| --- | --- |
| Creating a connection | Workspace Editor or higher |
| Listing connection names | Workspace Viewer or higher |
| Editing and deleting a connection | Workspace Owner, or (Workspace Viewer or higher and Connection Owner) |
| Changing a connection's permission settings | Workspace Owner, or (Workspace Viewer or higher and Connection Owner) |
| Running SQL on a connection / downloading execution results | Workspace Editor or higher, and Connection User or higher |
| Getting a connection's SQL execution results and table information | Workspace Viewer or higher, and Connection Viewer or higher |

### Access level: Private

Only users and groups granted a resource role can use this connection. Even the Workspace Owner can't change the connection's permission settings.

| Operation | Required role |
| --- | --- |
| Creating a connection | Workspace Editor or higher |
| Listing connection names | Workspace Viewer or higher, and Connection Viewer or higher |
| Editing and deleting a connection | Workspace Viewer or higher, and Connection Owner |
| Changing a connection's permission settings | Workspace Viewer or higher, and Connection Owner |
| Running SQL on a connection / downloading execution results | Workspace Editor or higher, and Connection User or higher |
| Getting a connection's SQL execution results and table information | Workspace Viewer or higher, and Connection Viewer or higher |

Operations on saved queries and the catalog also follow the permissions of the connection they're linked to. For details, see [Query](./query) and [Catalog](./catalog).