Roles & Permissions
Managing access through roles and rights.
The Data Mesh Manager implements role-based access control (RBAC).
Organization
An organization is a logical unit (tenant) that covers the data mesh of a company. To implement different environments, e.g. development and production, we recommend creating a separate organization for each environment.
Roles
The Data Mesh Manager offers the following roles for its users:
- Organization Member
- can view data products, data contracts, and global policies
- Organization Owner
- can view and edit all resources
- can edit organization members (invite new members, remove members, change roles)
- can create and delete teams
- can create API keys that have the same rights as an organization owner
- can create API keys that have the same rights as a team member
- Team Member (Domain Team)
- can edit data products for their team
- can edit data contracts for their team
- can request access to other data products as a data consumer
- can cancel data usage agreements as a data consumer
- can approve/reject/cancel data usage agreements for their team's data products as a data provider
- can invite other Organization Members to their team
- Team Member (Governance Group)
- can edit policies
A user can be a member of multiple organizations, and multiple teams per organization.
Permissions
- Data Products
- All organization members can view them
- Only the members of the team that owns the data product can edit them
- Data Usage Agreements
- All organization members can view them
- Only the members of the consuming team can request access to a provider's data product output port
- Only the members of the providing team can approve or reject requested data usage agreements
- Only the members of the providing and consuming teams can cancel approved data usage agreements
- Only the members of the providing and consuming teams can edit data usage agreements, with changes captured in audit trail