Immuta Users and Permissions

Learn about Immuta users, permissions, and license consumption

Permissions are a system-level mechanism that control what actions a user is allowed to take through the Immuta API and UI and reflect their user persona. Permissions can be added to any user by a user admin, but the permissions themselves are managed by Immuta and cannot be added or removed in the Immuta UI.

Immuta users

• Application admins: Application admins manage the configuration of Immuta for their organization. These users can configure Immuta to use external identity managers and catalogs, enable or disable data handlers, adjust email and cache settings, generate system API keys, and manage various other advanced settings.
• Auditors: Auditors can see and inspect all audit logs associated with Immuta and its integrations. This includes query, authentication, policy, project, and tag events from your Immuta users and data sources.
• Data owners: In order for data to be available in the Immuta platform, a data owner — the individual or team responsible for the data — needs to connect their data to Immuta. Once data is connected to Immuta, that data is called a data source. Once registered as a data source, the data owners have permission to set subscription policies and data policies on those data sources. Data owners can also build global policies just like governors, but they are restricted to only the data sources they own.
• Data users: Data users consume the data available through Immuta in their data platform as usual.
• Domain delegates: These users accountable to manage actions on data sources in a particular domain. This currently includes applying policies, auditing activity, managing identification, and creating data products.
• Governors: Governors set global policies within Immuta, meaning they can apply policies across all data sources. Governors can manage all tags and purposes and create domains, which are containers of data sources where users can be assigned a domain-specific permission to manage policies on only the data sources in those domains.
• Project managers: These users inspect, manage, approve, and deny various project changes, including purpose requests and project data sources.
• Project owners: These users can create their own project to get approvals for purpose-based access controls (PBAC).
• User admins: These users are able to manage the permissions, attributes, and groups that attach to each user. Permissions are only managed locally within Immuta, but groups and attributes can be managed locally or derived from user management frameworks, such as LDAP or Active Directory, that are external to Immuta.

The table below illustrates the global and domain permissions associated with each user.

Permissions

Permission	Scope	Persona	Actions
APPLICATION_ADMIN	Global	Application admin	Gives the user access to administrative actions to configure Immuta (e.g., configuring connections, adding external IAMs, connecting external catalogs, etc.)
AUDIT	Global	Auditor	Gives the user access to the audit logs
Audit Activity	Domain	Domain delegate	Audit domain-related activity within particular domain(s)
CREATE_DATA_SOURCE	Global	Data owner	Create data sources
CREATE_PROJECT	Global	Project owner	Create projects
FETCH_POLICY_INFO	Global	Data owner	Grants access to an endpoint that returns visibilities, masking information, and filters for a given data source
GOVERNANCE	Global	Governor	Create and manage purposes Create and manage tags Create global policies that apply to any data sources (inside or outside domains) Create, manage, and delete domains
IMPERSONATE_USER	Global	Data user	Impersonate other Immuta users: Before users can impersonate another user, an application admin must enable impersonation and grant that permission to users for most integrations. See the guides for your data platform for details.
Manage Data Products	Domain	Domain delegate	Publish and manage data products in the Request app
Manage Identifiers	Domain	Domain delegate	Manage identification and identifiers within a domain
Manage Policies	Domain	Domain delegate	Create policies that apply to the domain(s) they are authorized to
PROJECT_MANAGEMENT	Global	Project manager	Within projects they can Approve or deny purpose requests in projects Add or remove purposes and data sources Create new purposes
USER_ADMIN	Global	User admin	Manage user permissions, including domain-specific permissions on all domains

You can also create custom permissions, which should be used for assigning manual subscription policy approvals.

Data source roles

There are several roles that can be assigned to users and groups for a specific data source. See the Data sources in Immuta page for a list of data source roles and descriptions.

Audit

The following permission-related events are audited and can be found on the audit page in the UI:

• PermissionApplied: A global permission is applied to a user.
• PermissionRemoved: A global permission is removed from a user.
• DomainPermissionsUpdated: A domain-specific permission is applied to or removed from a user or group.

License consumption and user types

License consumption is determined by the count of enabled users on your Immuta tenant. Enabled users are one of these user types:

• Policy owners: Enabled users are counted as policy owners if they meet one of the following criteria:

  • User has one of the following global permissions (directly assigned or via group-based permission): CREATE_DATA_SOURCE, GOVERNANCE, USER_ADMIN, APPLICATION_ADMIN, IMPERSONATE_USER, PROJECT_MANAGEMENT, FETCH_POLICY_INFO, or AUDIT;
  • User has the Manage Policies domain-level permissions on at least one domain (directly assigned or via group-based permission)
  • User has one of the following data source level permissions on at least one data source (directly assigned or via group-based permission): owner or expert
• Data consumers: All enabled users that do not meet any of the criteria for policy owners are counted as data consumers.

To view the current level of license consumption for your Immuta tenant, see the Manage licenses API guide.