Personas and Permissions
Last updated
Last updated
Permissions are a system-level mechanism that control what actions a user is allowed to take through the Immuta API and UI. Permissions can be added to any user by a user admin (any user with the USER_ADMIN
permission), but the permissions themselves are managed by Immuta and cannot be added or removed in the Immuta UI; however, custom permissions can be created on the app settings page.
The table below illustrates what Immuta permissions map to specific Immuta personas.
Application admins
APPLICATION_ADMIN
These users have access to the administrative actions for the configuration of Immuta. They can
add
add
configure
Auditors
AUDIT
These users can access audit logs for their entire organization. Data owners can view audit logs for the data sources they own.
Data governors
GOVERNANCE
Data governors set within Immuta, meaning they can restrict the ways that data is used within Immuta across multiple projects and data sources. Governors can also set on projects, which can help limit the ways that data is used within Immuta. By default, governors can subscribe to data sources; however, can be disabled on the app settings page to remove the governor's ability to create or subscribe to data sources. Additionally, users can be a governor and admin simultaneously by default, but can also be changed to render the governor and admin roles mutually exclusive.
Data owners
To be a data owner, a user must have one of the following Immuta permissions or be manually assigned ownership of a data source:
CREATE_DATA_SOURCE
: Gives the user the ability to .
CREATE_DATA_SOURCE_IN_PROJECT
: Gives the user the ability to create data sources within a project.
Users who are manually assigned as owners of a data source do not need any Immuta permissions.
For data to be available in the Immuta platform, a data owner — the individual or team responsible for the data — needs to . Once data is connected to Immuta, that data is called a data source. In the process of creating a data source, data owners are able to on their data that restrict which users can access the data source, which rows within the data a user can access, and which columns within the data a user can see. Data owners can also view the in Immuta, but they are limited to only viewing records related to the data sources they own.
Data users
Users do not need any permissions assigned to them to subscribe to data sources. However, they can have any of the Immuta permissions described below:
CREATE_FILTER
: Gives the user the ability to create and save a search filter.
CREATE_PROJECT
: Gives the user the ability to .
IMPERSONATE_HDFS_USER
: When creating an HDFS data source, this allows the user to enter any HDFS user name to use when accessing data.
IMPERSONATE_USER
: Allows the user to when accessing data.
Data users query data that’s been made available through Immuta.
Project managers
PROJECT_MANAGEMENT
Project Managers oversee projects by in projects and adding and removing .
User admins
USER_ADMIN
These users have access to the administrative actions for managing users in Immuta. They can
create and manage users and
add and remove user permissions
create and manage user
See Manage personas and permissions for guidance on adding and removing permissions.