How access works
The two layers that decide which features you can open and which data you can read, and when a change takes effect.
Two separate things decide what you can do in Databaas: which features you can open, and which data you can read. They are granted in different places, and neither implies the other.
You sign in once. From there, two independent checks run — one when you open a feature, one on every query you make.
Two kinds of access
| Access to features | Access to data | |
|---|---|---|
| Controls | Whether Notebooks, Dashboards, Pipelines and the admin screens open at all. | Which warehouses, namespaces and tables you can read. |
| Granted in | Access control in the portal. | The Permissions tab of a warehouse, namespace or table in the Data Catalog. |
| Granularity | Five permissions, each platform-wide. | Per warehouse, namespace or table, to a person, a catalog role or an application. |
| Who changes it | Anyone with Administer platform. | Anyone with Manage grants or ownership on that object. |
Opening a feature is not the same as reading data inside it. With Use dashboards you can open Superset and see every chart listed, but a chart built on data you have no grant for returns an error instead of rows.
How a request is decided
You sign in once through single sign-on — with a Databaas account, or with your organisation’s own account where your instance is connected to it. Each feature checks whether you may open it, and every query is then authorised as you, against your own data grants. Pipelines work the same way under their own application identity:
When a change takes effect
- Feature permissions are checked live, on every request — no sign-out. They are cached briefly (a change can take about ten seconds to show), so wait around fifteen seconds and reload before concluding a change did not land.
- Data permissions are checked per query. A new grant applies to your next query; in the Data Catalog, use Check again on the “No rights yet” screen rather than reloading.
- Notebooks is checked at sign-in. A revoke does not stop a running notebook server, and a new grant applies the next time you sign in to Notebooks.
Who grants what
| Ask | For |
|---|---|
| A platform administrator | The five feature permissions, roles, and role membership. |
| A catalog administrator, or whoever owns the warehouse or namespace | Read or write access to a warehouse, namespace or table, for a person, a catalog role or a pipeline’s application identity. |
Granting data needs rights on the catalog object itself, which a platform administrator does not automatically hold — so the two are not always the same person.