Skip to main content
Permissions in this context are the data-level (lakehouse) rules that control what each Member can see and do with layers, folders, tables, and volumes. Owners and admins bypass all resource permissions: there is no way to restrict what an Owner or Admin can access. Only Members are restricted.
Data-level permissions are only enforced on Growth or Custom plans. On Starter, permissions are not enforced: every Member can access all data, pipelines, and the Context Layer. Creating or deleting Layers remains restricted to Owners and Admins.Changing plans does not change existing grants. When you upgrade from Starter to Growth, enforcement starts applying to the grants that already exist.

​
Permission levels

For Members, access to a layer, folder, table, or volume is one of: Members with no permission on a resource cannot see it. Permissions can be assigned directly to:
  • Layer
  • Folder (applies to everything inside it, including subfolders)
  • Table
  • Volume
Permissions only add access; there is no deny. A Member’s access is the highest level they receive from any direct grant or group. Access to sources, queries, notebooks, histories, destinations, and integrations is derived from the permissions on the tables they read and write:
  • To see a pipeline, a Member needs at least Viewer on every table it reads or writes.
  • To edit, activate, or trigger it, they need Editor on the tables it writes to. To delete it, they need Manager on those tables.
  • Input tables only need Viewer.
For sources, all of the source’s streams count, including disabled ones. Only streams removed from the source stop counting. Owners and admins can grant, change, or revoke any permission at any time. Members with Manager access to a resource can grant, change, or revoke Viewer and Editor access on that resource. Only owners and admins can grant or remove Manager access.

​
What each level can do

* Only admins and owners.
** Only owners. Saved Explorer queries are private to the person who saved them and do not depend on the saver’s permission level on the tables they reference. Members only see the General, Secrets, Referrals, and Documents settings. All other feature access follows from the tables (and layers, folders, and volumes) the member can access.

​
Permission propagation

  • From layer or folder down: Granting a Member access to a layer or folder gives them the same level of access to everything inside it: subfolders, tables, and volumes. This includes tables and volumes created later.
  • From folder, table, or volume up: Granting a Member access to a folder, table, or volume gives them at least Viewer access to the folders that contain it and to its layer. They do not get higher access to those containers unless you grant it separately.

​
Permission groups

You can assign permissions to a Group instead of (or in addition to) individual users. Members get the highest permission they have from any group or direct assignment. The default All group can be used to grant or revoke access for all members at once. New workspaces grant the All group Manager access to the default layers. Because permissions only add access, a team group with Viewer access does not restrict anyone while All still has Manager. To restrict a layer to specific teams, first lower or revoke the All group’s permission on it, then grant access to the team groups.

​
API tokens

API tokens inherit the permissions of the user who created them. If that user’s permissions change (e.g. new or revoked access, added or removed from a group, or role change), the token’s access changes the same way.

​
Examples

  • Members cannot create new layers, regardless of their permission level.
  • A Member cannot see a pipeline if they lack Viewer access to any of the tables it uses.
  • To create a new source, a Member needs Editor (or higher) access to the output layer (or folder), because the source creates tables there.
  • A Member with Editor access to a layer can edit sources that write to that layer and add new streams to those sources. Adding streams requires Editor on the output layer (or folder); removing streams requires Manager on their tables.
  • A Member can edit a source if they have Editor access to all of that source’s output tables, even without Editor access to the layer. Tables of disabled streams count for this check.

​
API & MCP

Platform API

List, assign, update, and revoke permissions across the three axes.

MCP tools

list_permissions, grant_permission, update_permission_level, and revoke_permission.