Roles Preview Optional feature

You can review the permissions of each workspace role and create and manage custom roles. A custom role is a workspace role that you build by choosing a permission level for each area. You can create roles with combinations of permissions that the built-in roles don't have, such as Editor permissions plus some management permissions, or view-only access to the areas you need.

INFO

This feature is in preview. To request access, contact Codatum support.

TIP

This is an optional feature. Depending on your contract, it might not be available.

Built-in roles and custom roles

There are built-in roles and custom roles. Both are workspace roles, and each user or service account is assigned exactly one.

Type	Description
Built-in role	Workspace Owner, Workspace Editor, Workspace Viewer, and Workspace Guest. Their permissions are fixed, and you can't change or delete them.
Custom role	A role you create for each workspace. You choose a level for each area in Permissions.

A custom role defines the default permissions across the whole workspace. Custom roles have no upper limit. When a user with a custom role is granted a resource role on a connection or teamspace, they can perform operations on that resource even if the custom role doesn't include them. Only the built-in Workspace Viewer and Workspace Guest roles act as an upper limit (Evaluation rules).

Custom roles are assigned and counted as follows:

• You can assign them to users and service accounts. You can't assign them to guests.
• Users with a custom role are members, not guests.
• Permissions limited to Workspace Owners, such as deleting the workspace or granting the Owner role, can't be included in a custom role.

Viewing roles

Open the global nav > Workspace settings > Roles to see the list of roles. All members except Workspace Guests can view the list and the details of each role.

Column	Description
Name	Built-in roles are marked Built-in.
Description	The description of the role.
Assigned	The number of users and service accounts assigned the role. Pending invitations aren't included.
Updated	When a custom role was last updated, and the member who updated it.

Select a row to open the role details, which show General (name and description) and Permissions. The Workspace Viewer details show the operations a viewer can't perform even when granted a resource role.

Creating a role

Only a Workspace Owner can create roles.

1. Open the global nav > Workspace settings > Roles.
2. From New role, choose a starting point.
   • Blank role: Every area starts at None.
   • Start from Editor: Starts with the same permissions as Workspace Editor.
3. Enter a Name and Description.
   • The name must be unique among the roles in the workspace, ignoring case. You can't use built-in role names, such as Owner or Editor.
   • For the maximum length of the name and description, see Limits.
4. Under Permissions, choose a level for each area.
5. Select Create.

To start from an existing custom role, open its details and select Duplicate. The creation screen opens with the permissions and description of the original role. The name is set to Copy of (role name).

You can't duplicate built-in roles. Workspace Owner has permissions that a custom role can't include, and Workspace Viewer has an upper limit.

Editing and deleting a role

Only a Workspace Owner can edit and delete roles. Other members see the role details as read-only.

1. Open the global nav > Workspace settings > Roles, and select a custom role.
2. Change the name, description, or permissions, and then select Save.

To delete a role, select Delete from the menu in the role details. Deletion can't be undone.

Editing and deleting work as follows:

• Changes to permissions apply to every user and service account assigned the role as soon as you save.
• You can't delete a role that's assigned. Assignments include pending invitations that specify the role. Change the role of those users and service accounts and delete the pending invitations first, and then delete the role.

Assigning a role

You choose a custom role on the same screens as a built-in role. Custom roles appear in the role options after the built-in roles.

Assigned to	Where to choose
Users	Changing a role on Users, and email invitations
Service accounts	Creating or editing a service account

Assigning and changing roles requires the Members permission. For details, see Assigning custom roles.

Users who join through allowed domains or an invite link can't be assigned a custom role. Change their role after they join.

Permissions

Permissions in the role details shows the following items under each heading. For items you can choose, select None or one of the levels. A higher level includes the lower levels. For example, if you select Manage, the member can also perform the Create operations.

Items you can't choose show a fixed value:

• All members: Always granted to every role.
• Workspace owners only: Can't be granted to a custom role.

Workspace

Item	Level	Description
View the workspace	All members	View the workspace and reports.
Workspace administration	Manage	Change workspace settings, security, and AI settings. For what's included, see Workspace permissions.
Audit logs	View	View audit logs.
Delete, plan, and API keys	Workspace owners only	Delete the workspace, view the plan and subscription, and manage API keys.
Service accounts and AI resources	Workspace owners only	Switch to any service account, and manage all AI profiles.

Members and groups

Item	Level	Description
Members	Invite, remove, and change roles	Invite and remove users other than Workspace Owners, and change their roles. Also create, edit, and delete service accounts.
Groups	Manage	Create groups and manage all groups.
Owner role and role definitions	Workspace owners only	Grant and revoke the Workspace Owner role, and create, edit, and delete roles.

A user with the Members permission can assign custom roles that have more permissions than their own. They can't grant or revoke the Workspace Owner role, or remove a Workspace Owner.

Connections

Item	Level	Description
Public connections	View	View connections whose access level is Workspace, and their schemas.
Public connections	Run	Run SQL on connections whose access level is Workspace.
Create and manage connections	Create	Add connections.
Create and manage connections	Manage	Update, delete, and change permissions on every connection whose access level is Workspace or Protected, including ones created by others.

When you select Manage for Create and manage connections, the member can reach every connection whose access level is Workspace or Protected. For a Protected connection, they can grant themselves a resource role and access its data. Connections with the Private access level aren't included.

Notebooks

Item	Level	Description
Workspace notebooks	View	View notebooks whose access scope is Workspace.
Workspace notebooks	Edit	Create and edit notebooks whose access scope is Workspace.
Workspace notebooks	Publish	Publish notebooks whose access scope is Workspace as reports or links.
Private notebooks	Edit	Create and edit notebooks whose access scope is Private.
Private notebooks	Share and publish	Share Private notebooks with others and publish them.
Create and manage teamspaces	Create	Create teamspaces.
Create and manage teamspaces	Manage	Manage and change permissions on every teamspace, including ones created by others.

Notebooks shared with the member can be viewed and edited within the range granted by the sharing settings, regardless of the permissions chosen in the custom role.

When you select Manage for Create and manage teamspaces, the member can add themselves as a Teamspace Owner even to teamspaces they haven't been granted access to. Once added, they can also access the notebooks in that teamspace.

Workflows

Item	Level	Description
Workflows	Create	Create workflows.
Workflows	Manage	Edit, run, and delete every workflow, including ones created by others.

Others

Item	Level	Description
Tag definitions	Edit	Create, edit, and delete tag definitions.
External integrations	Manage	Connect Slack integrations, create agent connectors, and manage all external integrations.

When you select Manage for External integrations, the member acts as an admin of every Slack integration and agent connector. Even if they aren't included in an integration's admins and users, they can edit and delete it and change its admins and users. Managing includes using. To let members use an integration without managing it, grant access in each integration's admins and users.

Limits based on your contract

• For the "Number of editors" limit (Limits), users with a custom role count in the same bucket as Workspace Owners and Editors, regardless of the permissions granted. This applies even to a custom role that only has view permissions. When the limit is reached, custom roles can't be selected.
• If this feature becomes unavailable because your contract changes, custom roles that are already assigned stay in effect. You can no longer create, edit, or delete roles, or newly assign a custom role.