Roles

Team Edition has five built-in roles: Administrator, Developer, Manager, Editor, and Viewer. Each role provides a baseline set of permissions for the web and desktop clients. A role defines what users can do after they receive access to Team Edition.

Info

For information on assigning a role, see Role management.

Administrator¶

Administrators configure Team Edition and have full access to the web and desktop clients. They manage users, teams, roles, licenses, authentication, server settings, shared projects, and user activity.

Administrators can also:

Create and delete shared projects, manage project access, and work with private projects when they're enabled.
Create, edit, and delete connections and project resources.
Run SQL, edit data and database objects, define dynamic dataset parameters, and manage tasks and schedules. When scheduling tasks, they can select team credentials.
Manage drivers and shared credentials for connections in shared projects. In the web client, they can share credentials with any team.
View administrative query history for all users.
Upload, edit, delete, and download files in Cloud Storage, and use AI features.

Important

At least one user must have the Administrator role. Team Edition doesn't limit the number of Administrators, but each Administrator uses a licensed role allocation.

Developer¶

Developers use the web and desktop clients for database development and project work. When private projects are enabled, they can access and use them. Developers can configure connections, manage project resources, run SQL, edit data and database objects, define dynamic dataset parameters, and manage and schedule tasks. Their scheduling dialog doesn't include the team credential selector.

In the web client, Developers can share credentials for connections they can edit with the default All users team. Desktop credentials are personal. Developers can also upload, edit, delete, and download files in Cloud Storage, and use AI features. They can't administer the server, users, teams, licenses, or drivers, or manage access to shared projects.

Manager¶

Managers use the web and desktop clients to work with existing connections. They can run SQL, edit data, import data, define dynamic parameters in datasets, and create, edit, move, or delete project resources such as SQL scripts, datasets, diagrams, and bookmarks. They can also upload, edit, delete, and download files in Cloud Storage, and use AI features. They can also view their personal Query History.

Managers can't configure connections, create database objects through the user interface, manage tasks, or switch the transaction commit mode. Connection permissions can further restrict SQL execution and data changes.

Editor¶

Editors use the web client to work with datasets prepared by Administrators, Developers, and Managers. They can browse, filter, and export dataset data. They can also edit and import data when the connection and team permissions permit it, and upload, edit, delete, and download files in Cloud Storage.

Editors don't have access to the Connections tree, SQL Editor, project scripts, query history, AI features, or the desktop client.

Viewer¶

Viewers use the web client to browse, filter, and export datasets. Their Cloud Storage access is read-only, so they can read and download files.

Viewers can't edit or import data, upload files to Cloud Storage, use the Connections tree or SQL Editor, access query history or AI features, or use the desktop client.

Supervisor¶

Supervisor is separate from the five built-in roles. An administrator assigns it to a user within a team, and the user keeps their existing Administrator, Developer, Manager, Editor, or Viewer role. Supervisors with the Administrator, Developer, or Manager role can view their team's queries in the web client's Tools -> Query History. Query History isn't available to Editors or Viewers.

Info

For information on assigning Supervisor access, see Supervisor.

Role capabilities¶

The following table shows the default capabilities for each built-in role. Project access, connection restrictions, and configurable team permissions still apply.

Capability	Administrator	Developer	Manager	Editor	Viewer
Administer the server and settings	+	-	-	-	-
Manage users, teams, roles, and licenses	+	-	-	-	-
Monitor all users in Query Manager	+	-	-	-	-
Create and delete shared projects	+	-	-	-	-
Manage access to shared projects	+	-	-	-	-
Manage drivers	+	-	-	-	-
Manage shared credentials for connections in shared projects	+	-	-	-	-
Share connection credentials with any team in the web client	+	-	-	-	-
Share connection credentials with the default All users team in the web client	+	+	-	-	-
Access and use private projects when enabled	+	+	-	-	-
Create, edit, and delete connections	+	+	-	-	-
Create and edit database objects through the user interface	+	+	-	-	-
Switch the transaction commit mode	+	+	-	-	-
Manage and schedule tasks	+	+	-	-	-
Define dynamic parameters in datasets	+	+	+	-	-
Use the desktop client	+	+	+	-	-
View connections in assigned projects	+	+	+	-	-
Create and edit SQL scripts and other project resources	+	+	+	-	-
Delete project resources and SQL scripts	+	+	+	-	-
Run SQL scripts and queries	+	+	+	-	-
Create, edit, and delete datasets	+	+	+	-	-
View personal query history	+	+	+	-	-
Use AI features	+	+	+	-	-
Edit data in the Data Editor	+	+	+	+	-
Import data	+	+	+	+	-
Upload, edit, and delete files in Cloud Storage	+	+	+	+	-
Use the Data Editor	+	+	+	+	+
Use Cloud Storage to read and download files	+	+	+	+	+
Browse, filter, copy, and export datasets	+	+	+	+	+
Generate API access token	+	+	+	+	+

Info

The role capabilities table shows the default access for each role. A user's effective access also depends on project access, project permissions, team permissions, and connection restrictions.

Project access¶

Role assignment doesn't automatically grant access to every shared project. Administrators assign users or teams to shared projects separately. After users receive project access, their role determines which project operations are available to them.

When private projects are enabled in administration, they become available automatically to Administrators and Developers during account initialization or when first needed. Users don't create them manually. Other roles work with shared projects assigned to them. Private projects aren't visible to other users, including Administrators.

Info

For information on project access, see Projects.

Project permissions¶

Projects contain connections, also called data sources, and resources such as SQL scripts, datasets, diagrams, bookmarks, and other files. Connections and project resources use separate permissions:

Connection permissions control whether users can view or edit connection configurations.
Resource permissions control whether users can view or modify project files.
Task permissions control whether users can manage and schedule tasks.

Creating, editing, moving, renaming, and deleting project resources use the same resource permission. For example, Developers and Managers can perform all these operations on SQL scripts, datasets, diagrams, and bookmarks in an assigned project. Renaming the project itself is available only to Administrators. Editors and Viewers can open prepared datasets but can't modify the underlying project resources.

Additional restrictions¶

Administrators can configure global permissions for SQL execution, data editing, data import, data copy, and data export. They can override the global defaults for individual teams. These global and team permissions constrain non-Administrator roles, and team permissions take priority over global permissions for team members.

Per-connection permissions apply to every role and can restrict data editing, metadata changes, SQL execution, and data import. A read-only connection also prevents operations that modify database data or structure. In the desktop client, Administrators and Developers can configure these per-connection restrictions, including read-only access.