How access works
The two layers that decide which features you can open and which data you can read, and when a change takes effect.
Two separate things decide what you can do in Databaas: which features you can open, and which data you can read. They are granted in different places, and neither implies the other.
You sign in once. From there, two independent checks run — one when you open a feature, one on every query you make.
Two kinds of access
| Access to features | Access to data | |
|---|---|---|
| Controls | Whether Notebooks, Dashboards, Pipelines and the admin screens open at all. | Which warehouses, namespaces and tables you can read. |
| Granted in | Access control in the portal. | The Permissions tab of a warehouse, namespace or table in the Data Catalog. |
| Granularity | Five permissions, each platform-wide. | Per warehouse, namespace or table. |
| Who changes it | Anyone with Administer platform. | Anyone who can grant on that object. |
Opening a feature is not the same as reading data inside it. With Use dashboards you can open Superset and see every chart listed, but a chart built on data you have no grant for returns an error instead of rows.
How a request is decided
You sign in once through single sign-on. Each feature checks whether you may open it, and every query is then authorised as you, against your own data grants:
When a change takes effect
- Feature permissions are checked live, on every request — no sign-out. They are cached briefly (a revoke has been measured taking about ten seconds), so wait around fifteen seconds and reload before concluding a change did not land.
- Data permissions are checked per query. A new grant applies to your next query; in the Data Catalog, use Check again on the “No rights yet” screen rather than reloading.
- Notebooks is checked at sign-in. A revoke does not stop a running notebook server, and a new grant applies the next time you sign in to Notebooks.
Who grants what
| Ask | For |
|---|---|
| A platform administrator | The five feature permissions, roles, and role membership. |
| An administrator, or whoever owns the warehouse | Read access to a warehouse, namespace or table. |
Granting data needs rights on the catalog object itself, which a platform administrator does not automatically hold — so the two are not always the same person.