> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nekt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> Data-level access control for layers, folders, tables, and volumes.

**Permissions** in this context are the data-level (lakehouse) rules that control what each [Member](https://docs.nekt.com/organizations/members.md) can see and do with [layers](https://docs.nekt.com/catalog/overview.md), folders, tables, and volumes. Admins bypass all resource permissions: there is no way to restrict what an Admin can access. Only Members are restricted.

> [!NOTE]
>
> Data-level permissions are **only enforced on Growth or Custom plans**. On Starter, permissions are not enforced: every Member can access all data, pipelines, and the Context Layer. Creating or deleting Layers remains restricted to Admins.
>
> Changing plans does not change existing grants. When you upgrade from Starter to Growth, enforcement starts applying to the grants that already exist.

## Permission levels

For Members, access to a layer, folder, table, or volume is one of:

| Level | Meaning |
| - | - |
| **Viewer** | Can see the resource and use it in read-only ways. Cannot change it or grant access to others. |
| **Editor** | Can change the resource and create dependent resources (e.g. new tables in the layer). Cannot delete the resource or manage who else has access. |
| **Manager** | Full control: can change, delete, and grant Viewer or Editor permission on that resource to other members (except Layers, which only admins can create or delete). |

Members with no permission on a resource cannot see it.

Permissions can be assigned directly to:

* **Layer**
* **Folder** (applies to everything inside it, including subfolders)
* **Table**
* **Volume**

Permissions only add access; there is no deny. A Member's access is the highest level they receive from any direct grant or group.

Access to sources, queries, notebooks, histories, destinations, and integrations is derived from the permissions on the tables they read and write:

* To see a pipeline, a Member needs at least Viewer on every table it reads or writes.
* To edit, activate, or trigger it, they need Editor on the tables it writes to. To delete it, they need Manager on those tables.
* Input tables only need Viewer.

For sources, all of the source's streams count, including disabled ones. Only streams removed from the source stop counting.

Admins can grant, change, or revoke any permission at any time. Members with Manager access to a resource can grant, change, or revoke Viewer and Editor access on that resource. Only admins can grant or remove Manager access.

## What each level can do

| Module | Viewer | Editor | Manager |
| - | - | - | - |
| See layers (with access) | ✓ | ✓ | ✓ |
| See tables (with access) | ✓ | ✓ | ✓ |
| Change layer/table/field descriptions | | ✓ | ✓ |
| Manage users (add, remove, change Viewer/Editor) | | | ✓ |
| Manage users (change Viewer/Editor/Manager)\* | | | |
| Create layers\* | | | |
| See all layers\* | | | |
| See sources, queries, notebooks, histories, destinations, integrations | ✓ | ✓ | ✓ |
| Add sources, destinations, queries, notebooks, histories | | ✓ | ✓ |
| Edit sources, destinations, queries, notebooks, histories | | ✓ | ✓ |
| Activate or deactivate sources, destinations, queries, notebooks, histories | | ✓ | ✓ |
| Manually trigger sources, destinations, queries, notebooks, histories | | ✓ | ✓ |
| Delete sources, destinations, queries, notebooks, histories | | | ✓ |
| See runs | ✓ | ✓ | ✓ |
| Execute queries | ✓ | ✓ | ✓ |
| See all settings pages\* | | | |
| Manage users and roles\* | | | |
| Create groups\* | | | |
| Add users\* | | | |
| Manage billing\*\* | | | |

\* Only admins.\
\*\* Only organization Owners.

Saved Explorer queries are private to the person who saved them and do not depend on the saver's permission level on the tables they reference.

Within a workspace, Members only see the General and Secrets settings.

All other feature access follows from the tables (and layers, folders, and volumes) the member can access.

## Permission propagation

* **From layer or folder down:** Granting a Member access to a layer or folder gives them the same level of access to everything inside it: subfolders, tables, and volumes. This includes tables and volumes created later.
* **From folder, table, or volume up:** Granting a Member access to a folder, table, or volume gives them at least Viewer access to the folders that contain it and to its layer. They do not get higher access to those containers unless you grant it separately.

## Permission groups

You can assign permissions to a [Group](https://docs.nekt.com/workspaces/groups.md) instead of (or in addition to) individual users. Members get the highest permission they have from any group or direct assignment. The default **All** group can be used to grant or revoke access for all members at once.

New workspaces grant the All group Manager access to the default layers. Because permissions only add access, a team group with Viewer access does not restrict anyone while All still has Manager. To restrict a layer to specific teams, first lower or revoke the All group's permission on it, then grant access to the team groups.

## API tokens

API tokens inherit the permissions of the user who created them. If that user’s permissions change (e.g. new or revoked access, added or removed from a group, or role change), the token’s access changes the same way.

## Examples

* Members cannot create new layers, regardless of their permission level.
* A Member cannot see a pipeline if they lack Viewer access to any of the tables it uses.
* To create a new source, a Member needs Editor (or higher) access to the output layer (or folder), because the source creates tables there.
* A Member with Editor access to a layer can edit sources that write to that layer and add new streams to those sources. Adding streams requires Editor on the output layer (or folder); removing streams requires Manager on their tables.
* A Member can edit a source if they have Editor access to all of that source’s output tables, even without Editor access to the layer. Tables of disabled streams count for this check.

## API & MCP

> **[Platform API](https://docs.nekt.com/platform-api/permissions/catalog/list.md)**
>
> List, assign, update, and revoke permissions across the three axes.

> **[MCP tools](https://docs.nekt.com/mcp-server/tools.md#list_permissions)**
>
> `list_permissions`, `grant_permission`, `update_permission_level`, and `revoke_permission`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.