This document describes how to manage members (users and user groups) in a DataBuddy workspace, configure workspace roles, and control access permissions to entity objects through ACLs (Access Control Lists).
Overview
DataBuddy permission management is divided into two levels: console-level and workspace-level, which are independent of CAM policies. Roles in DataBuddy are not directly bound to CAM policies.
The permission model consists of two parts:
Feature permissions (RBAC): feature usage permissions encapsulated through roles, such as "whether you can create workflows" and "whether you can manage notification channels". Feature permissions are implemented by assigning console roles or workspace roles to users/user groups.
Entity object access permissions (ACL): access permissions directly bound to specific entity objects (workflows, Notebooks, SQL files, compute resources, Dashboards, model experiments, model services, and so on), such as "user A has editable permission on Workflow1". Workspace administrators and the entity owner have all permissions on the entity by default, and other users access it based on the ACL configuration.
Note
The permissions a user actually has are the union of directly granted permissions + permissions inherited through user groups.
Role Definition
Console Role
|
Console administrator | Has full permissions for all features of the DataBuddy console, including workspace management, user/user group management, and platform settings. A sub-account with the AdministratorAccess policy is a console administrator by default and cannot have its console role modified. |
Console member | Has regular console access permissions, can only enter workspaces that the user has been added to, and cannot create workspaces or manage users. |
Space Role
|
Space administrator | Has full read, write, and delete permissions on all feature modules within the workspace, and can manage workspace users, roles, notifications, Git connections, and more. |
Space member | Has read, write, and delete permissions on all feature modules within the workspace except workspace management (user management, role permissions, notification management, and Git connections). |
Custom role | You can create custom workspace roles as needed and assign read/write/delete permissions to the roles by menu page. |
Note
The root account is the DataBuddy console administrator by default and automatically becomes the workspace administrator for all workspaces.
Managing Users in the Console
Console user management applies to the entire DataBuddy instance and determines which CAM sub-accounts can log in to DataBuddy and their console roles.
Adding a Console User
1. Log in to the DataBuddy console and choose User Management > Users in the left sidebar.
2. Click Add User.
3. Select the CAM sub-accounts to be added (multiple selection supported).
Note
Only CAM sub-accounts can be added as DataBuddy users. If no suitable sub-account is available in the list, go to the CAM console to create one. 1. Select the console role: Console Administrator or Console Member.
2. Click OK to complete the addition.
Modifying a Console User Role
1. In the User Management > Users list, click the role edit icon in the row of the target user.
2. In the pop-up window, select the new console role, and then click OK.
Note:
The root account and sub-accounts with the AdministratorAccess policy are console administrators by default. Their console roles cannot be modified, and the corresponding edit icon is grayed out.
Removing a Console User
1. In the User Management > Users list, click Remove in the row of the target user.
2. In the confirmation window, read the impact description:
Jobs running as this user will fail.
Dashboards published under this user identity will be inaccessible.
1. Click Confirm to complete the removal.
Warning
Removing a console user is an irreversible operation. After removal, the user can no longer use DataBuddy.
Managing Console User Groups
Console user groups are used to manage users' workspace access in batches. Common operations include:
In User Management > User Groups, click Add to create a user group (name limit: 128 characters).
Go to the Members Tab of the user group to add or remove members.
Modify the user group name or delete the user group. After deletion, all permissions granted to the group will be removed from its members.
Managing Members in a Workspace
Workspace member management applies to the current workspace and determines which console users/user groups can access the workspace and their roles within it.
Adding a Workspace Member
1. Go to the target workspace and choose Workspace Settings > User Management > Users in the left sidebar.
2. Click Add User and select one or more users from the console user list.
3. Assign a space role to the new member (Space Admin, Space Member, or a custom role).
4. Click OK to complete the addition.
Adding Members via a User Group
On the User Management > User Groups tab, click Add User Group to bring the entire console user group into the workspace and assign it a workspace role. Users in the user group will appear in the user list simultaneously. Members added through a user group are displayed in the user list but cannot be removed individually. They must be removed from the user group as a whole.
Note
hover over the member count of a user group to quickly view all members currently in the group.
Modifying a Member's Workspace Role
Both individual modification and batch modification are supported:
Individual modification: Click the role edit icon in the user's row, and select a new role in the pop-up window.
Batch modification: Select multiple users, click Batch Modify Role above the list, and assign a new workspace role to all of them.
Removing a Workspace Member
1. In the Workspace Settings > User Management > Users list, locate the target user.
2. Click Remove in the row of that user.
3. DataBuddy will list the jobs that will run as this user. Before clicking Confirm, review the impact of these jobs and, if necessary, adjust the Run As configuration of the jobs.
Note:
Members who enter the workspace through a user group cannot be removed individually. You need to remove the entire user group on the User Groups tab, or remove the user from the user group at the console level.
Custom Role Management
If the preset "Space Admin" and "Space Member" roles cannot meet your needs in specific scenarios, you can create custom space roles.
1. Go to Workspace Settings > User Management > Roles.
2. Click Create Custom Role.
3. Enter the role name and description.
4. Assign read/write/delete permissions to this role by menu (Data Ingestion, Studio, Catalog, Workflow, Data Exploration, Dashboard, ChatBI, Model Experiment, Model Management, Model Service, Agent, Application, Compute Resources, and more).
5. Click Save to complete the creation.
Custom roles support copy, edit, and delete operations.
Access Control List (ACL) for Entity Objects
ACL is used to restrict who can operate a specific entity object. Common entity objects and permission types in DataBuddy:
|
Computing Resource | Manage, Edit, View, Use |
Folder / File | Manage, Edit, Run, View |
Workflow | Manage, Run, View |
Notebook File | Manage, Edit, Run, View |
SQL File | Manage, Edit, Run, View |
Data Access Task | Manage, Edit, Run, View |
Data Access Data Source | Manage, Edit, View, Use |
Dashboard | Manage, Edit, Run, View |
ChatBI Space | Manage, Edit, Run, View |
Model Experiment | Manage, Edit, View |
Model Service | Manage, Edit, View, Use |
Note
Permissions for data assets such as catalogs, schemas, tables, views, volumes, functions, and models belong to the Catalog permission model. They are introduced in the Data Catalog section and are not managed in workspace ACLs.
Permission Semantics
|
Manage | Has full control over the object: edit, run, delete, modify ACLs, transfer ownership, and more. |
Edit | Can edit object content, such as modifying Notebook cells, SQL code, and field mappings, but cannot modify ACLs or delete objects. |
Run | Can run objects, such as running Notebooks, running workflows, and querying dashboards, but cannot edit code or configurations. |
View | Can only view object content, such as details, parameters, and run history, but cannot run, edit, or modify it. |
Use | Can reference objects in consumer scenarios, such as selecting a data source / compute resource in a task, but cannot modify object configurations. |
Note
If a user does not have any permission on an entity (including the View permission), the entity is not visible in the list. If a user does not have permission for a feature button, the button is grayed out, and a hover tip shows "You do not have permission to access this feature. Contact the owner for authorization."
Configuring ACLs for Entity Objects
ACL entries vary by module. For detailed configuration, see the documentation of each module. The general entry is:
1. Go to the list page or details page of the entity object.
2. Click Permission Management in the Operation column or Permissions in the upper-right corner of the details page.
3. In the permission management dialog, select the users or user groups that need authorization.
4. Assign one of the above permission types to each user / user group.
5. Click Save.
Permission Inheritance (Folders)
Folders in DataBuddy Studio support permission inheritance:
Objects in a folder inherit all permission settings from the parent folder;
When you modify the permissions of a parent folder, the permissions of all objects under it are updated synchronously.
Even if users do not have permission for the parent folder, they can still see the name of the parent folder (for path navigation) as long as they have permission for the child object, but they cannot access other sibling objects.
Use Limits
CAM Sub-account Prerequisite: DataBuddy users must be existing CAM sub-accounts. Root accounts cannot be added as regular users.
Super Admin Role Cannot Be Modified: The console role of root accounts and sub-accounts with the AdministratorAccess policy is fixed as Console Administrator.
Removing User Group Members: Members who enter a workspace through a user group cannot be removed from the workspace individually. They must be removed as part of the entire user group.
owner Default Permissions: The creator (owner) of an entity object has the Manageable permission by default, and this permission cannot be revoked.
FAQs
Why Can't I See the User in the Workspace Even Though They Have Been Added in the Console?
Console users and workspace members are managed independently at two levels. Console users must be added again in Workspace Settings > User Management and assigned a workspace role before they can enter the workspace to use its features.
How to Troubleshoot "No Permission" When Users Are Prompted for Notebooks They Created?
This usually occurs because restrictive permissions are configured on the parent folder of the Notebook. Check the ACL configuration of the Studio folder to confirm that the user has at least the View permission on the parent folder.
How to Transfer Workspace Ownership to Another User?
Transferring ownership of an entity object must be performed in the Permission Management dialog or on the details page of the corresponding entity. Some entities, such as semantic models and metrics, currently do not support ownership transfer. For details, see the ACL table of each module.