User Access Control for the DataOps Platform

This page explains how access is controlled on the DataOps platform and which permissions you need for each area (Builder, DevOps, Blueprints, Marketplace, Computational Policy).

User access is managed through Blindata permissions and enforced by the Blindata Agent. To grant or modify permissions for a user, follow the permissions guide .

For the full list of available permissions, see:

• DataOps Permissions
• Blueprint Permissions
• Governance Policy
• Data Products
• Marketplace

The DataOps Module Permission Matrix below summarizes what each permission allows on the platform.

DATAOPS_ADMIN users always have full access to all DataOps platform services.

Granular Control and Permission Inheritance

In addition to platform-level permissions, you can grant access to specific Data Products in two ways:

• Teams — Assign Data Products to a team with defined access policies. See the Teams Management Guide .
• Stewardship (ACL) — Assign responsibilities (e.g. Data Product Owner) so that access is based on the Access Control List (ACL) of each Data Product. See the Stewardship Responsibilities Guide .

When a row in the tables below shows Team or Stewardship, the user must have the corresponding access (team membership or stewardship role on that Data Product) in addition to the listed permission.

Examples:

• John can read objects associated with the “Finance” team.

Alternatively, Access Control Lists (ACLs) can be enabled based on responsibilities assigned to specific objects. For example:

• Mary is the Data Product Owner for the “Invoices” Data Product and has full access to it.

Permission Overview by Functionality

Before you start:

• DATAOPS_ADMIN can perform all operations in this section; no other permission is needed for admins.
• AGENTS_VIEWER is required to use the Blindata Agent (and thus to interact with DataOps services).
• For operations on a specific Data Product, the user must have DATA_PRODUCTS_EDITOR and the appropriate access via Team or Stewardship (see Granular Control and Permission Inheritance ).

The tables below list the permission required for each operation by module. A ✔️ in Team or Stewardship means that, in addition to the permission, the user must have access through team membership or stewardship responsibility on that Data Product.

Builder

Data Product and descriptor lifecycle, and repository operations. Repository operations also require authentication and the right permissions on the underlying Git provider. Builder admin operations require DATAOPS_ADMIN.

DevOps

Activity lifecycle operations:

Blueprint

Blueprint operations:

Marketplace

Marketplace operations:

Computational Policy

Governance policy deployment and evaluation:

For more on the Data Product Builder (initialization, descriptor editing, and publishing), see the Data Product Builder guide.

DataOps Module Permission Matrix

Summary of what each permission allows on the DataOps platform: