Define roles

In Data Access, a role is a type of access control that grants its beneficiaries access, such as Read, Write, or Admin, on data objects.

You define a role in two parts:

• Granted access: The data objects and the permissions that the role grants on them.
• Beneficiaries: Users who receive that access.

Grant access on data objects

To grant your role's beneficiaries access on specific data objects:

1. On the role page, in the Granted access section, click Add.
2. In the Add access dialog box, select the Data objects option, and then click Continue.
3. In the Add data object dialog box, select the data objects, and then click Add with Read access.
   Tip You can edit the permissions later, and this is described in the next step. But if you want to select a different permission now, click the menu next to Add with Read access and then click Select permissions.
4. To check or change the permissions for a data object:
   1. On the role page, in the Access on data objects section, in the Permissions column for the data object, double-click the current value.
   2. In the Edit permissions on [data object] dialog box, select the required permissions.
      Tip 

      • The underlying permissions for each permission group (Read, Write, and Admin) are indicated by checkboxes. The listed permissions and their descriptions vary by data source.
      • To select more permissions within a permission group, select the corresponding checkboxes. If you want to exclude the entire permission group, click the corresponding button.
      • To select other permission groups, such as Write or Admin, click the corresponding buttons. Clicking the button again clears your selection.
   3. Click Save.

Dynamically grant access on data objects

Unlike a fixed selection of data objects, a dynamic rule keeps a role's access up to date. With a dynamic rule, a role grants access on a data object only when the object meets your conditions, and stops granting access when it no longer does.

To grant your role's beneficiaries access on the data objects that meet specific conditions:

1. On the role page, in the Granted access section, click Add.
2. In the Add access dialog box, select the Dynamic rule option, and then click Continue.
3. In the Add dynamic rule dialog box, select the data objects (the scope) from the same data source to include in the dynamic rule, and then click Next.
   Tip 

   • If you see the message Select data objects from the same data source to configure a dynamic rule, it means that the data objects that you selected as the scope of your dynamic rule come from more than one data source. A dynamic rule can be configured only on objects within a single data source. To resolve this, select objects from only one data source. If you need the same dynamic rule for multiple data sources, create a separate dynamic rule for each one.
   • If you see the message No contained data object types exist under the selected scope, it means that the scope that you selected has nothing underneath it that a dynamic rule can apply to. For example, you may have selected an object at the lowest level, such as a table with no child types, or one whose child types cannot be granted permissions. Dynamic rules work on the data objects that the scope contains. To resolve this, select a higher-level scope that contains the objects that you want to target, such as a schema or database.
4. In the Which conditions should apply dialog box, in the Data object types field, select the types of data objects that the dynamic rule applies to, within your selected scope.
   Tip 

   • The tag conditions, which you specify later, are then evaluated only against objects of the selected types.
   • If the Data object types field is read-only and already contains a type, it means that only one type applies to your selected scope.
5. Select the required permissions for the data objects by clicking Read, Write, or Admin.
6. Click Add expression, specify the required conditions, and then click Save.
   Tip 

   • The Key field includes the tag keys that are imported from all the connected data sources.
   • You can add more expressions and combine them with AND or OR logic.
   • You can preview the results by clicking See results. The results show the data objects that currently meet the tag conditions. This lets you validate the scope of your dynamic rule before it is applied to your data sources.

Grant access on other roles

You can allow your role's beneficiaries to inherit the access that is provided by other roles.

To grant your role's beneficiaries access on specific roles:

1. On the role page, in the Granted access section, click Add.
2. In the Add access dialog box, select the Roles option, and then click Continue.
3. In the Add role dialog box, select the roles, and then click Add.

Grant access on column masks

A column mask masks data in specific columns from everyone except its beneficiaries, who can see unmasked data. You can allow your role's beneficiaries to see unmasked data in those columns.

To grant your role's beneficiaries unmasked access on the columns that are included in specific column masks:

1. On the role page, in the Granted access section, click Add.
2. In the Add access dialog box, select the Column masks option, and then click Continue.
3. In the Add mask dialog box, select the column masks, and then click Add.

Grant access on row filters

A row filter hides all rows in a specific table or view from everyone except the beneficiaries of its filter rules. Each filter rule shows only the rows that meet its filter criteria. You can allow your role's beneficiaries to see those rows by adding the filter rules to your role.

To grant your role's beneficiaries access on rows that meet specific filter rules:

1. On the role page, in the Granted access section, click Add.
2. In the Add access dialog box, select the Row filters option, and then click Continue.
3. In the Add filter dialog box, select the filter rules, and then click Add.

Change when granted access expires

By default, an access control that you add to a role remains linked to the role indefinitely. You can make the link temporary by setting an expiration date and time. When that date and time pass, the access control is automatically removed from the role, and the role's beneficiaries lose the access that came through the access control.

To change the expiration date for an access control:

1. On the role page, in the Access on [access control type] section, in the Expires at column for the access control, double-click the current value.
   
2. In the Set expiration date dialog box, select the new expiration date and time, and then click Apply.

Grant access to identities or groups

To grant specific identities or groups access on the data objects:

1. On the role page, in the Beneficiaries section, click Add.
2. In the Which type of beneficiary do you want to add dialog box, select the Identities or Groups option, and then click Continue.
3. In the Which [entity] do you want to add dialog box, select the entities, and then click Add.
4. In the How should access be granted dialog box, select one of the following options, and then click Add.

   Option	Description
   Granted	Grants the beneficiaries immediate access on the data objects until the expiration date. The default expiration date is Unlimited.
   On request	Grants the beneficiaries preapproved access on the data objects. The preapproval is available until the expiration date, which is Unlimited by default. Beneficiaries can request access from an asset that is linked to this role. When they submit a request, access is automatically granted for 14 days, which is the default grant period for preapproved access. You can change the grant period in the Grant access for field, which appears when you select the On request option.

Dynamically grant access to identities

Unlike a fixed selection of identities, a dynamic rule keeps a role's beneficiaries up to date. With a dynamic rule, identities are granted access only when they meet your conditions, and lose that access when they no longer do.

To grant the identities that meet specific conditions access on the data objects:

1. On the role page, in the Beneficiaries section, click Add.
2. In the Which type of beneficiary do you want to add dialog box, select the Dynamic rule option, and then click Continue.
3. In the Which conditions should apply dialog box, specify the required conditions, and then click Continue.
4. In the How should access be granted dialog box, select the Granted or On request option, and then click Add.

Grant access to beneficiaries of other roles

To grant the beneficiaries of specific roles access on the data objects:

1. On the role page, in the Beneficiaries section, click Add.
2. In the Which type of beneficiary do you want to add dialog box, select the Roles option, and then click Continue.
3. In the Which roles do you want to add dialog box, select the roles, and then click Add.

Change when beneficiary access expires

By default, a beneficiary that you add to a role keeps a role's access indefinitely. You can give a beneficiary time-limited access by setting an expiration date and time. When that date and time pass, the beneficiary is automatically removed from the role and loses the access that came through it.

To change the expiration date for a beneficiary:

1. On the role page, in the Beneficiaries section, in the Expires at column for the beneficiary, double-click the current value.
   
2. In the Set expiration date dialog box, select the new expiration date and time, and then click Apply.

Related topics

• About roles
• Manage access controls