[{"data":1,"prerenderedAt":1376},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fgovernance\u002Fpermissions":3,"docs-nav":1169},{"id":4,"title":5,"body":6,"description":16,"extension":1161,"meta":1162,"navigation":1164,"path":1165,"seo":1166,"stem":1167,"__hash__":1168},"docs\u002Fdocs\u002Fgovernance\u002Fpermissions.md","Permissions",{"type":7,"value":8,"toc":1143},"minimark",[9,13,17,22,103,107,112,115,122,126,142,153,160,176,179,182,185,195,199,279,286,290,305,312,323,327,356,363,375,383,402,406,409,430,437,444,448,478,485,492,496,511,515,518,533,540,544,547,806,818,822,829,835,845,861,869,929,938,995,1000,1054,1058,1090,1094,1139],[10,11,5],"h1",{"id":12},"permissions",[14,15,16],"p",{},"Tabularia decides who may see and do what with folders: every object lives in a folder,\nand a permission granted on a folder, to a user or to a group, holds for the folder and\neverything below it. This page is for administrators and for whoever looks after a\nteam's folders: the model, the five capabilities, the administrator and observer roles,\nand what each common action needs.",[18,19,21],"h2",{"id":20},"at-a-glance","At a glance",[23,24,25,36],"table",{},[26,27,28],"thead",{},[29,30,31,34],"tr",{},[32,33],"th",{},[32,35],{},[37,38,39,48,56,64,72,87,95],"tbody",{},[29,40,41,45],{},[42,43,44],"td",{},"Unit of permission",[42,46,47],{},"a folder, inherited by its subfolders",[29,49,50,53],{},[42,51,52],{},"Subjects",[42,54,55],{},"users, groups (a user gets the grants of every group they belong to), service accounts",[29,57,58,61],{},[42,59,60],{},"Capabilities",[42,62,63],{},"VIEW, RUN, EDIT, MANAGE (each includes the ones before it) and CONNECT (on its own)",[29,65,66,69],{},[42,67,68],{},"Kind of rules",[42,70,71],{},"grants only: there is no deny",[29,73,74,77],{},[42,75,76],{},"Where",[42,78,79,80,84,85],{},"Explore → a folder → ",[81,82,83],"strong",{},"Folder settings"," → ",[81,86,5],{},[29,88,89,92],{},[42,90,91],{},"Who grants",[42,93,94],{},"whoever has MANAGE on the folder; administrators everywhere",[29,96,97,100],{},[42,98,99],{},"Roles above folders",[42,101,102],{},"administrator (personal or through a group), observer (reads the administration panels)",[18,104,106],{"id":105},"how-it-works","How it works",[108,109,111],"h3",{"id":110},"folders","Folders",[14,113,114],{},"Flows, datasources, connections, saved views, SQL scripts, Python and R scripts,\nnotebooks, reports, dashboards and flow groups all belong to exactly one folder. Folders nest. Only administrators create\ntop-level folders (the personal folders below aside); whoever has MANAGE on a folder creates\nfolders inside it.",[14,116,117,118,121],{},"A permission on a folder holds for every subfolder, however deep. The folders above the\nones you can read show in Explore by ",[81,119,120],{},"name only",", so the path to your folders can be\nwalked; their content stays hidden. Because there are only grants, a subfolder cannot\nbe closed to someone who has a permission above it: keep data that a group must not see\nin a branch of its own.",[108,123,125],{"id":124},"personal-folders","Personal folders",[14,127,128,129,133,134,137,138,141],{},"Every person gets a folder of their own when their account is created: by an\nadministrator, at the first single sign-on, or as the first administrator at start-up.\nIt sits at the top level and is named after the part of the email before the @\n(",[130,131,132],"code",{},"leonardtriv@example.com"," gets ",[130,135,136],{},"leonardtriv","); when a top-level folder has that name\nalready, it takes a number, as copies do (",[130,139,140],{},"leonardtriv (1)","). Accounts created before\nthis release get theirs at their next sign-in.",[14,143,144,145,148,149,152],{},"The person has EDIT on it: they upload files there, build flows, datasources, views and\nreports and dashboards, run and schedule them, and rename the folder. Nobody else is granted anything,\nand a top-level folder inherits nothing: only the person and the administrators see it.\nIn Explore it comes first, with a key on the folder and the tag ",[81,146,147],{},"My folder","; an\nadministrator sees everyone's, after the shared folders, tagged ",[81,150,151],{},"Personal",".",[14,154,155,156,159],{},"The person does ",[81,157,158],{},"not"," have MANAGE, and that is deliberate:",[161,162,163,170],"ul",{},[164,165,166,169],"li",{},[81,167,168],{},"no CONNECT",": a connection can point at any host the workers reach, so being able to\ncreate one is what lets someone copy data out of the installation or probe the internal\nnetwork. It stays a right an administrator gives. Data reaches the folder from the\nconnections the person was granted elsewhere;",[164,171,172,175],{},[81,173,174],{},"no sharing and no subfolders",": a folder its person could share would let a copy of a\ndatasource they may only read reach people nobody granted it to.",[14,177,178],{},"An administrator can grant more on it, as on any folder: a colleague's access, or\nCONNECT or MANAGE to the person. Python and R scripts, notebooks and Container nodes still\nneed the use of their environment or registry, which the folder does not give.",[14,180,181],{},"So that it is not lost by mistake, nobody but an administrator can delete it, move it\nunder another folder or remove the person's own EDIT, even with MANAGE on it. Should an\nadministrator delete it or take that grant away, the person gets a new, empty one at\ntheir next sign-in.",[14,183,184],{},"When the account is deactivated nothing changes. When it is deleted, an empty folder goes\nwith it; one holding anything stays, with its content, as an ordinary top-level folder\nthat only the administrators and whoever it was shared with see: the content belongs to\nthe organization, as everywhere else.",[14,186,187,188,191,192,152],{},"Service accounts and accounts that only observe get none: a public demo's guest is one\naccount shared by many visitors, and a folder of its own would let any of them write.\nUpgrading from a version where the person held MANAGE lowers that grant to EDIT and\nremoves the MANAGE and CONNECT grants on these folders; connections already made there\nstay, and only the administrators see them.\nThe creation is in the audit log as ",[130,189,190],{},"folder.create",", with ",[130,193,194],{},"\"personal\": true",[108,196,198],{"id":197},"the-capabilities","The capabilities",[23,200,201,214],{},[26,202,203],{},[29,204,205,208,211],{},[32,206,207],{},"Capability",[32,209,210],{},"Lets you",[32,212,213],{},"Includes",[37,215,216,228,240,253,266],{},[29,217,218,223,226],{},[42,219,220],{},[81,221,222],{},"VIEW",[42,224,225],{},"see the folder's content; open flows, datasources, saved views, scripts, reports and dashboards; preview and export data; read a report or a dashboard and download it; ask the assistant about the datasources",[42,227],{},[29,229,230,235,238],{},[42,231,232],{},[81,233,234],{},"RUN",[42,236,237],{},"run flows, refresh datasources, write a SQL script's datasource, run scripts and flow groups, and schedule all of them",[42,239,222],{},[29,241,242,247,250],{},[42,243,244],{},[81,245,246],{},"EDIT",[42,248,249],{},"create, change, rename, move, duplicate and delete content; write a datasource's data contract; publish a flow's result into the folder",[42,251,252],{},"RUN, VIEW",[29,254,255,260,263],{},[42,256,257],{},[81,258,259],{},"MANAGE",[42,261,262],{},"grant and revoke permissions on the folder, create subfolders, move and delete folders",[42,264,265],{},"EDIT, RUN, VIEW, CONNECT",[29,267,268,273,276],{},[42,269,270],{},[81,271,272],{},"CONNECT",[42,274,275],{},"see, create, change, test, browse and use the folder's connections",[42,277,278],{},"nothing else",[14,280,281,282,285],{},"CONNECT stands apart on purpose. Someone with VIEW, RUN or EDIT on a folder does ",[81,283,284],{},"not\nsee"," its connections; someone with CONNECT alone sees the connections and nothing else.\nThat is how a team is allowed to import from the ERP database without being able to\nchange the flows next to the connection, or the other way round.",[108,287,289],{"id":288},"dashboards","Dashboards",[14,291,292,293,298,299,301,302,304],{},"A ",[294,295,297],"a",{"href":296},"\u002Fdocs\u002Fcapabilities\u002Fdashboards","dashboard"," is an object of its folder: ",[81,300,222],{}," opens it, chooses\nits parameters, clicks, refreshes it and downloads its PDF and its image; ",[81,303,246],{}," designs, renames,\nmoves, duplicates and deletes it, and restores a version. Without VIEW it answers as one that does not\nexist.",[14,306,307,308,311],{},"Opening it lends no rights. What each tile reads is checked with the rights of ",[81,309,310],{},"whoever reads",", at\nevery request and before anything shared is looked at: a tile on a dataset the reader may not read\nsays so inside the tile, with no number and no name of a column, whether or not someone else has just\nread it, and the other tiles work.",[14,313,314,315,318,319,152],{},"A flow group that sends one reads with the rights of ",[81,316,317],{},"whoever runs the group",": the author of its\nschedule, for a scheduled run, checked again at every send. Nobody looks at it before it leaves, so a\ndataset the author may not read stops the cell, with its name, and nothing is sent. Someone else who\nchanges what the dashboard reads switches the schedule off: the\n",[294,320,322],{"href":321},"\u002Fdocs\u002Fpushmail#dashboards","rules of the Pushmail cell",[108,324,326],{"id":325},"granting","Granting",[14,328,329,330,332,333,335,336,339,340,343,344,347,348,351,352,355],{},"In Explore, open the folder and its ",[81,331,83],{}," (shown only with MANAGE). The\n",[81,334,5],{}," list shows the grants made on ",[81,337,338],{},"this"," folder, not the ones inherited\nfrom above. Choose ",[81,341,342],{},"Group"," or ",[81,345,346],{},"User",", the subject, the capability, then ",[81,349,350],{},"Grant",".\nIn the interface, administrators grant to single users and to groups, other folder\nmanagers to groups (the API, ",[130,353,354],{},"POST \u002Fprojects\u002F{id}\u002Fpermissions",", takes either). The cross beside a grant revokes it.",[14,357,358],{},[359,360],"img",{"alt":361,"src":362},"Folder settings of the folder Finance: the group finance with edit, the group finance-leads with manage, and the form to grant a capability to a group with the list view, run, edit, connect, manage open","\u002Fmedia\u002Fguide\u002Fgovernance\u002Ffolder-settings-permissions.png",[14,364,365],{},[366,367,368,370,371,374],"em",{},[81,369,83],{}," of ",[130,372,373],{},"Finance",", as in the example below: two grants on this folder, and the form for a third with the five capabilities.",[14,376,377,378,382],{},"Prefer groups. A person who changes team changes groups, and the folders follow.\nWith single sign-on the groups can come from the identity provider\n(",[294,379,381],{"href":380},"\u002Fdocs\u002Fdesign\u002Fsso-group-mapping","group mapping",").",[14,384,385,386,389,390,393,394,397,398,401],{},"Every grant and revocation is in the audit log (",[130,387,388],{},"permission.grant",",\n",[130,391,392],{},"permission.revoke","), and so is moving a folder (",[130,395,396],{},"folder.move","), which changes what its\nwhole subtree inherits. Moving a folder needs MANAGE on the folder ",[81,399,400],{},"and"," on its new\nparent.",[108,403,405],{"id":404},"administrators","Administrators",[14,407,408],{},"An administrator can do everything, everywhere, whatever the folder grants say. Someone\nis an administrator either by their own flag or by membership of an administrators'\ngroup:",[161,410,411,421],{},[164,412,413,416,417,420],{},[81,414,415],{},"Administration → Users",": ",[81,418,419],{},"Make administrator"," on the person.",[164,422,423,416,426,429],{},[81,424,425],{},"Administration → Groups",[81,427,428],{},"Make the group's members administrators",";\neveryone in the group, and anyone who joins later, is an administrator.",[14,431,432,433,436],{},"With single sign-on, ",[130,434,435],{},"OIDC__SUPERUSER_GROUP"," names the identity provider's group whose\nmembers are administrators; the personal flag is then rewritten at every SSO sign-in, so\nuse a Tabularia group for anything that must stick. Nobody can remove their own\nadministrator rights, by any route: another administrator must do it, which also keeps\nat least one administrator in place.",[14,438,439,440,443],{},"Administrators alone manage users, groups, group membership, service accounts,\nwebhooks, the engines that may be chosen, the AI models, scripting environments,\ncontainer registries, the SIEM forwarding, backups and the settings of the\n",[81,441,442],{},"Administration"," page. The export to dbt is for administrators only, because the\nproject it produces carries definitions and data from other folders too.",[108,445,447],{"id":446},"observers","Observers",[14,449,450,451,454,455,454,458,454,461,454,464,467,468,471,472,474,475,382],{},"An observer reads the administration panels without being able to change anything:\n",[81,452,453],{},"Admin",", ",[81,456,457],{},"Queue",[81,459,460],{},"Monitoring",[81,462,463],{},"Performance",[81,465,466],{},"Cluster"," and ",[81,469,470],{},"Audit",", under\n",[81,473,442],{},". It suits an auditor, a security officer or an on-call colleague. The\nrole is granted like the administrator's, on a person or on a group (the eye button,\n",[81,476,477],{},"Open the administration panels read-only",[14,479,480,481,484],{},"What an observer sees is masked: emails as ",[130,482,483],{},"a***@example.com"," (the domain stays), no IP\naddresses, no browser strings, and in the audit details no hosts, paths, SQL,\nrecipients or people's names. Their own actions are recorded without their IP address\nand browser.",[14,486,487,488,491],{},"An account that is ",[81,489,490],{},"only"," an observer is treated as a shared account, the kind a\npublic demo signs everyone in with: it has no personal API tokens, cannot change its\npassword, sees and closes only its own session, and its questions to the assistant are\nnot saved. On its folders it has whatever it was granted, usually VIEW.",[108,493,495],{"id":494},"service-accounts","Service accounts",[14,497,498,499,502,503,506,507,152],{},"A service account is an integration rather than a person: an administrator creates it in\n",[81,500,501],{},"Administration → Service accounts","; it has no password and signs in only with\nits API tokens. It gets permissions like anyone else, from its groups and from folder\ngrants. A token is never more powerful than its account, and a ",[366,504,505],{},"Read only"," token refuses\nevery change. The details are in ",[294,508,510],{"href":509},"\u002Fdocs\u002Fapi#signing-in-api-tokens","the API guide",[108,512,514],{"id":513},"schedules-run-with-their-authors-rights","Schedules run with their author's rights",[14,516,517],{},"A scheduled flow, refresh, flow group, script or SQL script runs with the rights of the\nperson who set the schedule, and those rights are checked again every time it fires:",[161,519,520,523,526],{},[164,521,522],{},"an author who is disabled or deleted switches the schedule off;",[164,524,525],{},"a right the author no longer has stops the run before it starts: depending on the\nobject, the run is recorded as failed with the reason, or the schedule switches\nitself off;",[164,527,528,529,532],{},"a change by ",[81,530,531],{},"someone else"," that makes the object reach further (another source,\nanother output connection or publish folder, new code in a Script node, another image\nin a Container node, the object moved to another folder) switches the schedule off,\nand the audit log says why. The author's own changes keep it.",[14,534,535,536,152],{},"So a schedule never does more than its author chose, with rights the author still has.\nSee ",[294,537,539],{"href":538},"\u002Fdocs\u002Fcapabilities\u002Fscheduling","Scheduling",[18,541,543],{"id":542},"what-each-action-needs","What each action needs",[14,545,546],{},"\"On the folder\" means the folder of the object acted on.",[23,548,549,559],{},[26,550,551],{},[29,552,553,556],{},[32,554,555],{},"Action",[32,557,558],{},"Needs",[37,560,561,569,577,585,593,601,609,617,625,633,641,649,657,665,673,681,689,696,704,712,720,728,736,744,752,759,767,775,783,791,798],{},[29,562,563,566],{},[42,564,565],{},"See a folder's datasources, flows, views, scripts, groups",[42,567,568],{},"VIEW on the folder",[29,570,571,574],{},[42,572,573],{},"Preview a datasource, open it in the Viewer, export it as CSV or Excel",[42,575,576],{},"VIEW on the datasource's folder",[29,578,579,582],{},[42,580,581],{},"Upload a file",[42,583,584],{},"EDIT on at least one folder",[29,586,587,590],{},[42,588,589],{},"Create a datasource from a database, SFTP, S3, an API or SharePoint",[42,591,592],{},"EDIT on the destination folder and CONNECT on the connection's folder",[29,594,595,598],{},[42,596,597],{},"Refresh a database datasource, or schedule its refresh",[42,599,600],{},"RUN on the datasource's folder and CONNECT on the connection's folder",[29,602,603,606],{},[42,604,605],{},"Rename, move, delete a datasource",[42,607,608],{},"EDIT on its folder (and on the new one, to move it)",[29,610,611,614],{},[42,612,613],{},"Read a datasource's data contract",[42,615,616],{},"VIEW on its folder",[29,618,619,622],{},[42,620,621],{},"Write, check or remove a data contract",[42,623,624],{},"EDIT on the datasource's folder",[29,626,627,630],{},[42,628,629],{},"Open a flow",[42,631,632],{},"VIEW on its folder, and the use of every scripting environment and container image it runs",[29,634,635,638],{},[42,636,637],{},"Create, change, delete a flow",[42,639,640],{},"EDIT on its folder",[29,642,643,646],{},[42,644,645],{},"Run a flow",[42,647,648],{},"RUN on its folder, VIEW on every datasource it reads, EDIT on the folder it publishes to, CONNECT on every connection an Output node writes to or sends email through",[29,650,651,654],{},[42,652,653],{},"Schedule a flow",[42,655,656],{},"RUN on its folder (and all the above, again, at every run)",[29,658,659,662],{},[42,660,661],{},"Run an unsaved flow from the editor",[42,663,664],{},"RUN on the folders of the data it reads",[29,666,667,670],{},[42,668,669],{},"Ask the flow assistant to change a flow",[42,671,672],{},"EDIT on the flow's folder",[29,674,675,678],{},[42,676,677],{},"Ask the assistant about data",[42,679,680],{},"VIEW on the datasources it reads",[29,682,683,686],{},[42,684,685],{},"See, create, change, test or browse a connection",[42,687,688],{},"CONNECT on the connection's folder",[29,690,691,694],{},[42,692,693],{},"Open a flow group, see its runs",[42,695,616],{},[29,697,698,701],{},[42,699,700],{},"Create, change, delete a flow group",[42,702,703],{},"EDIT on its folder, and RUN on the folder of every flow, datasource or script added as a cell",[29,705,706,709],{},[42,707,708],{},"Run or schedule a flow group",[42,710,711],{},"RUN on its folder; each cell is checked again when it runs",[29,713,714,717],{},[42,715,716],{},"A Pushmail cell",[42,718,719],{},"CONNECT on the SMTP connection and VIEW on every datasource it attaches",[29,721,722,725],{},[42,723,724],{},"Open a saved view",[42,726,727],{},"VIEW on its folder, and VIEW on its datasource to see the data",[29,729,730,733],{},[42,731,732],{},"Save a view",[42,734,735],{},"EDIT on the destination folder and VIEW on the datasource",[29,737,738,741],{},[42,739,740],{},"Open and run a SQL script",[42,742,743],{},"VIEW on its folder; on a connection, CONNECT on it; the datasources it names readable by you",[29,745,746,749],{},[42,747,748],{},"Write a SQL script's datasource, schedule it",[42,750,751],{},"RUN on the script's folder and EDIT on the datasource's folder",[29,753,754,757],{},[42,755,756],{},"Save, move, delete a SQL script",[42,758,640],{},[29,760,761,764],{},[42,762,763],{},"See a Python or R script",[42,765,766],{},"VIEW on its folder and the use of its environment",[29,768,769,772],{},[42,770,771],{},"Run or schedule a Python or R script",[42,773,774],{},"RUN on its folder; EDIT where it publishes",[29,776,777,780],{},[42,778,779],{},"Grant permissions, create subfolders, delete a folder",[42,781,782],{},"MANAGE on the folder",[29,784,785,788],{},[42,786,787],{},"Delete or move a personal folder, remove its person's MANAGE",[42,789,790],{},"administrator",[29,792,793,796],{},[42,794,795],{},"Create a top-level folder, export a flow to dbt",[42,797,790],{},[29,799,800,803],{},[42,801,802],{},"Read the audit log and the other administration panels",[42,804,805],{},"administrator or observer",[14,807,808,809,389,813,817],{},"Who may use a scripting environment or a container registry is set by an administrator\nper group (",[294,810,812],{"href":811},"\u002Fdocs\u002Fscripting#who-can-use-an-environment","Python and R",[294,814,816],{"href":815},"\u002Fdocs\u002Fcontainer-registries","Container registries","). Someone without it cannot open a\nflow that uses it: the flow is listed greyed out, with the reason.",[18,819,821],{"id":820},"example-a-finance-team","Example: a Finance team",[14,823,824,825,828],{},"The sales data comes from the ERP and the CRM, imported into a folder ",[81,826,827],{},"Sales"," by the\ndata team. Finance should read it, build its own flows and reports in its own folder,\nand touch nothing else.",[14,830,831,834],{},[81,832,833],{},"1. Folders."," An administrator creates two top-level folders:",[836,837,842],"pre",{"className":838,"code":840,"language":841},[839],"language-text","Sales                 ← datasources orders, order_rows, customers; the ERP connection\nFinance\n└── Reports           ← created later by Finance itself\n","text",[130,843,840],{"__ignoreMap":844},"",[14,846,847,850,851,853,854,467,857,860],{},[81,848,849],{},"2. Groups."," In ",[81,852,425],{},", the administrator creates\n",[130,855,856],{},"finance",[130,858,859],{},"finance-leads"," and adds the people (or lets single sign-on fill them).",[14,862,863,850,866,868],{},[81,864,865],{},"3. Grants.",[81,867,83],{}," of each folder:",[23,870,871,885],{},[26,872,873],{},[29,874,875,878,880,882],{},[32,876,877],{},"Folder",[32,879,342],{},[32,881,207],{},[32,883,884],{},"Why",[37,886,887,901,915],{},[29,888,889,891,895,898],{},[42,890,827],{},[42,892,893],{},[130,894,856],{},[42,896,897],{},"view",[42,899,900],{},"read orders and customers, preview, export",[29,902,903,905,909,912],{},[42,904,373],{},[42,906,907],{},[130,908,856],{},[42,910,911],{},"edit",[42,913,914],{},"build flows and views, run them, publish results here",[29,916,917,919,923,926],{},[42,918,373],{},[42,920,921],{},[130,922,859],{},[42,924,925],{},"manage",[42,927,928],{},"create subfolders, grant access to colleagues",[14,930,931,932,934,935,937],{},"The same grant over the API, with an administrator's token (folder 7 is ",[81,933,827],{},",\ngroup 4 is ",[130,936,856],{},"):",[836,939,943],{"className":940,"code":941,"language":942,"meta":844,"style":844},"language-bash shiki shiki-themes github-dark-dimmed github-light","curl -X POST https:\u002F\u002Ftabularia.example.com\u002Fapi\u002Fprojects\u002F7\u002Fpermissions \\\n  -H \"Authorization: Bearer tab_…\" -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"group_id\": 4, \"capability\": \"view\"}'\n","bash",[130,944,945,969,986],{"__ignoreMap":844},[946,947,950,954,958,962,965],"span",{"class":948,"line":949},"line",1,[946,951,953],{"class":952},"sqRhv","curl",[946,955,957],{"class":956},"swcJU"," -X",[946,959,961],{"class":960},"sXfbr"," POST",[946,963,964],{"class":960}," https:\u002F\u002Ftabularia.example.com\u002Fapi\u002Fprojects\u002F7\u002Fpermissions",[946,966,968],{"class":967},"sxsTv"," \\\n",[946,970,972,975,978,981,984],{"class":948,"line":971},2,[946,973,974],{"class":956},"  -H",[946,976,977],{"class":960}," \"Authorization: Bearer tab_…\"",[946,979,980],{"class":956}," -H",[946,982,983],{"class":960}," \"Content-Type: application\u002Fjson\"",[946,985,968],{"class":967},[946,987,989,992],{"class":948,"line":988},3,[946,990,991],{"class":956},"  -d",[946,993,994],{"class":960}," '{\"group_id\": 4, \"capability\": \"view\"}'\n",[14,996,997],{},[81,998,999],{},"4. What follows.",[161,1001,1002,1027,1036,1042],{},[164,1003,1004,1005,1008,1009,1012,1013,1016,1017,1019,1020,1023,1024,1026],{},"A Finance analyst builds a flow in ",[81,1006,1007],{},"Finance\u002FReports"," that joins ",[130,1010,1011],{},"orders"," and\n",[130,1014,1015],{},"customers"," from ",[81,1018,827],{}," and publishes ",[130,1021,1022],{},"Monthly revenue by channel"," into\n",[81,1025,1007],{},": VIEW on Sales covers the reads, EDIT on Finance covers the run\nand the publish.",[164,1028,1029,1030,1032,1033,1035],{},"They do not see the ERP connection in ",[81,1031,827],{}," (no CONNECT), so they cannot refresh\n",[130,1034,1011],{}," or import new tables: the data team keeps that.",[164,1037,1038,1039,1041],{},"They schedule the flow every morning. If they later leave the ",[130,1040,856],{}," group, the\nnext scheduled run does not start and records why.",[164,1043,292,1044,1046,1047,1049,1050,1053],{},[130,1045,859],{}," member grants VIEW on ",[81,1048,1007],{}," to the ",[130,1051,1052],{},"management","\ngroup: managers read the reports, and nothing else of Finance.",[18,1055,1057],{"id":1056},"limits-and-good-to-know","Limits and good to know",[161,1059,1060,1066,1072,1078,1084],{},[164,1061,1062,1065],{},[81,1063,1064],{},"No deny, no per-object grants."," Permissions are on folders only; a datasource\nthat a group must not see goes in a folder that group has no grant on, above or below.",[164,1067,1068,1071],{},[81,1069,1070],{},"Moving changes access."," An object moved into another folder takes that folder's\npermissions. Moving a folder takes its whole subtree with it, which is why it needs\nMANAGE at both ends.",[164,1073,1074,1077],{},[81,1075,1076],{},"Changes are immediate."," Rights are read at every request, so a revoked grant, a\nremoved group membership or a removed administrator flag takes effect on the next\nclick; open sessions are not needed to end.",[164,1079,1080,1083],{},[81,1081,1082],{},"Deleting a user"," removes their grants, group memberships, sessions and tokens; what\nthey created stays, and their audit entries keep their email.",[164,1085,1086,1089],{},[81,1087,1088],{},"Folder deletion"," needs MANAGE and an empty folder: no subfolders, flows,\ndatasources, connections or other objects.",[18,1091,1093],{"id":1092},"related","Related",[161,1095,1096,1103,1110,1117,1124,1132],{},[164,1097,1098,1102],{},[294,1099,1101],{"href":1100},"\u002Fdocs\u002Fgovernance","Security and governance",": the map.",[164,1104,1105,1109],{},[294,1106,1108],{"href":1107},"\u002Fdocs\u002Fgovernance\u002Faudit-log","Audit log",": what every grant, run and export leaves behind.",[164,1111,1112,1116],{},[294,1113,1115],{"href":1114},"\u002Fdocs\u002Fconcepts","Concepts",": folders, flows, datasources and runs.",[164,1118,1119,1123],{},[294,1120,1122],{"href":1121},"\u002Fdocs\u002Fconnections","Connections",": CONNECT, kind by kind.",[164,1125,1126,467,1130,152],{},[294,1127,1129],{"href":1128},"\u002Fdocs\u002Fsso-keycloak","Single sign-on with Keycloak",[294,1131,381],{"href":380},[164,1133,1134,1138],{},[294,1135,1137],{"href":1136},"\u002Fdocs\u002Fapi","Tabularia API",": tokens and service accounts.",[1140,1141,1142],"style",{},"html pre.shiki code .sqRhv, html code.shiki .sqRhv{--shiki-default:#F69D50;--shiki-light:#6F42C1}html pre.shiki code .swcJU, html code.shiki .swcJU{--shiki-default:#6CB6FF;--shiki-light:#005CC5}html pre.shiki code .sXfbr, html code.shiki .sXfbr{--shiki-default:#96D0FF;--shiki-light:#032F62}html pre.shiki code .sxsTv, html code.shiki .sxsTv{--shiki-default:#F47067;--shiki-light:#005CC5}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}",{"title":844,"searchDepth":971,"depth":988,"links":1144},[1145,1146,1157,1158,1159,1160],{"id":20,"depth":971,"text":21},{"id":105,"depth":971,"text":106,"children":1147},[1148,1149,1150,1151,1152,1153,1154,1155,1156],{"id":110,"depth":988,"text":111},{"id":124,"depth":988,"text":125},{"id":197,"depth":988,"text":198},{"id":288,"depth":988,"text":289},{"id":325,"depth":988,"text":326},{"id":404,"depth":988,"text":405},{"id":446,"depth":988,"text":447},{"id":494,"depth":988,"text":495},{"id":513,"depth":988,"text":514},{"id":542,"depth":971,"text":543},{"id":820,"depth":971,"text":821},{"id":1056,"depth":971,"text":1057},{"id":1092,"depth":971,"text":1093},"md",{"source":1163},"docs\u002Fgovernance\u002Fpermissions.md",true,"\u002Fdocs\u002Fgovernance\u002Fpermissions",{"title":5,"description":16},"docs\u002Fgovernance\u002Fpermissions","UZIQGlpYSyKMAlQDok5wuOUhTa7kkeEzl6W4DsBHKAQ",[1170,1187,1237,1269,1297,1322,1342,1368],{"title":1171,"icon":1172,"intro":1173,"items":1174},"Getting started","start","Install it on one machine, learn the few ideas everything else is built on, and run a first flow.",[1175,1177,1180,1183,1184],{"path":1176,"title":1171},"\u002Fdocs\u002Fgetting-started",{"path":1178,"title":1179},"\u002Fdocs\u002Fgetting-started-docker-compose","Walkthrough with Docker Compose",{"path":1181,"title":1182},"\u002Fdocs\u002Fdeploy\u002Fminikube","Try it on your computer (minikube)",{"path":1114,"title":1115},{"path":1185,"title":1186},"\u002Fdocs\u002Foverview","Overview (README)",{"title":60,"icon":1188,"intro":1189,"items":1190},"capabilities","What you can build: visual flows, analysis on any step, AI questions, pixel-perfect reports, dashboards, Python, R and SQL scripts, containers and the orchestration that ties them together.",[1191,1194,1197,1200,1203,1206,1209,1210,1212,1215,1218,1221,1224,1225,1228,1231,1234],{"path":1192,"title":1193},"\u002Fdocs\u002Fcapabilities","All capabilities",{"path":1195,"title":1196},"\u002Fdocs\u002Fcapabilities\u002Fflows","Low-code flows",{"path":1198,"title":1199},"\u002Fdocs\u002Fcapabilities\u002Fpreview-and-analysis","Preview and analysis",{"path":1201,"title":1202},"\u002Fdocs\u002Fcapabilities\u002Fask-your-data","Ask your data with AI",{"path":1204,"title":1205},"\u002Fdocs\u002Fcapabilities\u002Freports","Pixel-perfect reports",{"path":1207,"title":1208},"\u002Fdocs\u002Fcapabilities\u002Freport-functions","Report functions",{"path":296,"title":289},{"path":1211,"title":812},"\u002Fdocs\u002Fscripting",{"path":1213,"title":1214},"\u002Fdocs\u002Fsql-scripts","SQL scripts",{"path":1216,"title":1217},"\u002Fdocs\u002Fcapabilities\u002Fnotebooks","marimo notebooks as apps",{"path":1219,"title":1220},"\u002Fdocs\u002Fcontainer-node","Docker images in flows",{"path":1222,"title":1223},"\u002Fdocs\u002Fcapabilities\u002Fflow-groups","Flow groups: orchestration",{"path":538,"title":539},{"path":1226,"title":1227},"\u002Fdocs\u002Fpushmail","Pushmail: datasources, reports and dashboards by email",{"path":1229,"title":1230},"\u002Fdocs\u002Fplaceholders","Dynamic dates",{"path":1232,"title":1233},"\u002Fdocs\u002Fcapabilities\u002Fengines","Engines",{"path":1235,"title":1236},"\u002Fdocs\u002Fengines\u002Fengine-differences","Engine differences",{"title":1238,"icon":1239,"intro":1240,"items":1241},"Sources","sources","Every way data comes in: files, databases, buckets, SFTP folders, HTTP APIs, SharePoint, Google Sheets, and the results of your own flows.",[1242,1245,1248,1251,1254,1257,1260,1263,1266],{"path":1243,"title":1244},"\u002Fdocs\u002Fsources","All sources",{"path":1246,"title":1247},"\u002Fdocs\u002Fsources\u002Ffiles","Uploaded files",{"path":1249,"title":1250},"\u002Fdocs\u002Fsources\u002Fdatabases","Database tables and queries",{"path":1252,"title":1253},"\u002Fdocs\u002Fs3-datasource","S3 buckets",{"path":1255,"title":1256},"\u002Fdocs\u002Fsftp","SFTP folders",{"path":1258,"title":1259},"\u002Fdocs\u002Fapi-datasource","HTTP APIs",{"path":1261,"title":1262},"\u002Fdocs\u002Fsources\u002Fsharepoint","Excel on SharePoint",{"path":1264,"title":1265},"\u002Fdocs\u002Fsources\u002Fgoogle-sheets","Google Sheets",{"path":1267,"title":1268},"\u002Fdocs\u002Fsources\u002Fflow-outputs","Results of flows and scripts",{"title":1122,"icon":1270,"intro":1271,"items":1272},"connections","The systems Tabularia reads from and writes to, how each connection is set up, and who may use it.",[1273,1275,1278,1281,1284,1286,1287,1289,1290,1293,1294],{"path":1121,"title":1274},"All connections",{"path":1276,"title":1277},"\u002Fdocs\u002Fconnections\u002Fdatabases","Databases",{"path":1279,"title":1280},"\u002Fdocs\u002Fsqlserver","Microsoft SQL Server driver",{"path":1282,"title":1283},"\u002Fdocs\u002Fconnections\u002Fs3","S3 and compatible storage",{"path":1255,"title":1285},"SFTP servers",{"path":1258,"title":1259},{"path":1261,"title":1288},"SharePoint",{"path":1264,"title":1265},{"path":1291,"title":1292},"\u002Fdocs\u002Fconnections\u002Fsmtp","SMTP email",{"path":815,"title":816},{"path":1295,"title":1296},"\u002Fdocs\u002Fconnections\u002Fdestinations","Writing data out",{"title":1298,"icon":1299,"intro":1300,"items":1301},"Integrations","integrations","How Tabularia fits your stack: AI providers, the REST API and webhooks, dbt, OpenLineage, single sign-on, SIEM and monitoring.",[1302,1305,1308,1310,1313,1316,1317,1320],{"path":1303,"title":1304},"\u002Fdocs\u002Fintegrations","All integrations",{"path":1306,"title":1307},"\u002Fdocs\u002Fintegrations\u002Fai","AI: where it is used",{"path":1136,"title":1309},"API, tokens and webhooks",{"path":1311,"title":1312},"\u002Fdocs\u002Fdbt-export","Export to dbt",{"path":1314,"title":1315},"\u002Fdocs\u002Fopenlineage","OpenLineage",{"path":1128,"title":1129},{"path":1318,"title":1319},"\u002Fdocs\u002Fsiem-splunk","Audit log to Splunk",{"path":1321,"title":460},"\u002Fdocs\u002Fintegrations\u002Fmonitoring",{"title":1323,"icon":1324,"intro":1325,"items":1326},"Security & governance","governance","Who may see and do what, what is recorded, and how data quality and personal data are kept in check.",[1327,1329,1330,1331,1334,1336,1339],{"path":1100,"title":1328},"Overview",{"path":1165,"title":5},{"path":1107,"title":1108},{"path":1332,"title":1333},"\u002Fdocs\u002Fgovernance\u002Fdata-contracts","Data contracts",{"path":380,"title":1335},"SSO and group mapping",{"path":1337,"title":1338},"\u002Fdocs\u002Fexamples\u002Fkeycloak","Keycloak example on a laptop",{"path":1340,"title":1341},"\u002Fdocs\u002Fengines\u002Fclickhouse-ai-user","A ClickHouse user for the AI assistant",{"title":1343,"icon":1344,"intro":1345,"items":1346},"Install & operate","operate","Run it in production on Kubernetes, configure it, upgrade it and keep it healthy.",[1347,1350,1353,1356,1359,1362,1365],{"path":1348,"title":1349},"\u002Fdocs\u002Fdeploy\u002Fkubernetes","Kubernetes and Helm",{"path":1351,"title":1352},"\u002Fdocs\u002Fdeploy\u002Fkind","A company-like cluster on one computer (kind)",{"path":1354,"title":1355},"\u002Fdocs\u002Fdeploy\u002Fupgrading","Upgrading, backups and restore",{"path":1357,"title":1358},"\u002Fdocs\u002Fdeploy\u002Frelease-checklist","Install and upgrade checklist",{"path":1360,"title":1361},"\u002Fdocs\u002Fconfiguration","Configuration reference",{"path":1363,"title":1364},"\u002Fdocs\u002Fengine-settings","Settings from the panel",{"path":1366,"title":1367},"\u002Fdocs\u002Fdatabase-migrations","Database migrations",{"title":1369,"icon":1370,"intro":1371,"items":1372},"Reference","reference","Release process and the remaining reference pages.",[1373],{"path":1374,"title":1375},"\u002Fdocs\u002Frelease-process","Release process",1793656372155]