References → Security Roles
About Security Roles
Incorta defines access control through Users, Groups, and Roles. The Security Manager manages these entities.
A user can belong to no groups or multiple groups, and a group can be assigned to no roles or multiple roles. A user inherits all roles assigned to the groups they belong to. Roles define specific permissions within the platform and are immutable. You cannot create, edit, or delete a role.
Security model
Incorta employs an optimistic security model, which means that Incorta enforces the least restrictive role permissions and access rights. All users inherit the User role. A tenant administrator inherits the SuperRole by default. There is no direct way to assign a role to a user. Instead, you can assign one or more roles to a group. A group is a collection of zero or more users. You may assign a user to one or more groups.
Role-based access control
Role-Based Access Control (RBAC) enforces access to certain features and functionalities within Incorta Analytics Service. The Incorta Loader Service is not accessible. The Incorta Cluster Management console is a separate web interface and is enabled for a single administrator user.
There is no direct way to assign a role to a user, with two exceptions:
- All users inherit the User role
- A tenant administrator inherits the SuperRole role unless otherwise configured for the tenant
Role descriptions
| Role | Role Type | Description |
|---|---|---|
| User | User Role | Can perform the following: ● View, favorite, apply filters, and create bookmarks in dashboards that are shared with them. ● Hide the tab and filter bars when viewing a dashboard. ● The default role assigned to a user. |
| Privileged User | User Role | Can share dashboards and folders, and publish dashboards via email and schedules. |
| Dashboard Analyzer | User Role | Can personalize, share, and publish dashboards via email and schedules. |
| Individual Analyzer | User Role | Can perform the following: ● Create and modify folders. ● Create, modify, and personalize dashboards, and also access the Analyzer. ● Cannot share dashboards or folders. |
| Analyze User | User Role | Can perform the following: ● Create and modify folders. ● Create, modify, and personalize dashboards, and also access the Analyzer. ● Share or publish dashboards via email and schedules. |
| Advanced Analyzer User | User Role | Can perform the following: ● Create and modify folders. ● Create, modify, and personalize dashboards, and also access the Analyzer. ● Share dashboards and folders, and publish dashboards via email and schedules. ● Use Augmented Analytics and Business Notebook. ● Install SDK Components from the marketplace. Note: This role is available starting 2024.7.x. After upgrading to 2024.7.x, users who created business Notebooks in a previous release must be assigned this role to continue to have access to their business Notebooks. |
| Copilot User | User Role | Can use Copilot (Nexus) and view shared dashboards and business schemas. Note: ● This role is available starting 2024.7.2 and is required for any user who intends to interact with the Copilot capabilities in various contexts. For example, a schema manager should also be assigned this role to leverage Nexus capabilities when building materialized views. At the same time, an Individual Analyzer requires it to leverage natural language to Insight capabilities. ● Starting 2025.7.1, Incorta Copilot has been renamed to Incorta Nexus. |
| Data Catalog User | User Role | Can view the Data Catalog and manage assets they have edit access to. |
| Data Governor | User Role | Can create and manage the Data Catalog, including definitions, documentation, and data asset assignments. |
| Schema Manager | Admin Role | Can perform the following: ● Create and modify schemas, business schemas, data connections, and data destinations. ● Load data and share schemas with other users and groups. |
| User Manager | Admin Role | Can create and modify users and groups, and assign roles and users to groups. |
| SuperRole | Super Role | Has full access to all permissions. Note: Users with the SuperRole or the Super User role can view only dashboards and folders that they own or have access rights to. |
You can limit users with "User" or "Individual User" roles from downloading insights by disabling the Download insights option available under Default Tenant Configurations → Security in the Cluster Management Console (CMC).
Role permissions
There are four levels of permissions a Role might have for different content uses of Incorta. In descending order, a Role can: Manage, Share, View, or have no permissions. Having a higher level of permission access grants the permissions of the lower levels.
| Role | Catalog (Content) | Schema | Security | Data Connection | Data Destination (Dashboard Destination) | Data Catalog | Data Flow (Data Studio) |
|---|---|---|---|---|---|---|---|
| User | View | ||||||
| Privileged User | Share | ||||||
| Dashboard Analyzer | Share | ||||||
| Individual Analyzer | Manage* | View | View | ||||
| Analyze User | Manage | View | View | ||||
| Advanced Analyzer User | Manage | View | View | Manage | |||
| Copilot User | Manage | View (Business Schema) | |||||
| Data Catalog User | View | ||||||
| Data Governor | Manage | ||||||
| Schema Manager | Manage | Manage | Manage | Manage | |||
| User Manager | Manage | ||||||
| SuperRole | Manage | Manage | Manage | Manage | Manage | Manage | Manage |
Role permissions for other Incorta components
The following table lists certain Roles’ additional permissions for other Incorta components:
| Role | SDK_Component | Standalone_Notebook | Advanced_Augmented_Analytics |
|---|---|---|---|
| Advanced Analyzer User | Manage | Manage | |
| Copilot User | Manage | ||
| SuperRole | Manage | Manage | Manage |
- Catalog refers to the Content tab in the Navigation bar, Data Destination refers to Dashboard Destination, and Data Flow refers to Data Studio.
- The Individual Analyzer can manage the Catalog (Content), but cannot share.
- Users with only the Advanced Analyzer User, Analyze User, or Individual Analyzer roles have limited access to the Business Schema Manager, where they can view a list of business schemas shared with them without the need to be assigned the Schema Manager role. They can only open a shared business schema in the Business Schema Designer view mode, explore its data, export it, and view its description and sharing configurations.
- Before 2024.7.x, the Analyze User role could manage Business Notebooks. However, starting 2024.7.x, this role is not sufficient to manage or access Business Notebooks.
User Permissions
Incorta determines permissions based on a combination of assigned roles and access rights granted when sharing objects.
Together, these factors define the functionalities and features available to users.
For example:
- If a user, Joe, belongs only to a group with the User role, which only permits viewing access to the Catalog (Content Manager), and another user, Tom, grants Joe edit rights to a dashboard, Joe can only view the dashboard.
- Similarly, if Joe belongs to a group with the Analyze User role, which allows users to manage the Catalog, and Tom grants Joe view access to a dashboard, Joe will be restricted to viewing the dashboard.
Role content access
| Role | Manage Dashboards | Manage Folders | Share or Publish | Analyzer | Scheduler | Schema / Business Schema | Data | Data Studio | Data Catalog | Security |
|---|---|---|---|---|---|---|---|---|---|---|
| User | No | No | No | No | Yes** | No | No | No | No | No |
| Privileged User | No | No | Yes | No | Yes** | No | No | No | No | No |
| Dashboard Analyzer | Yes*** | No | Yes | No | Yes** | No | No | No | No | No |
| Individual Analyzer | Yes | Yes | No | Yes | Yes** | Yes | No | No | No | No |
| Analyze User | Yes | Yes | Yes | Yes | Yes** | Yes | No | No | No | No |
| Advanced Analyzer User | Yes | Yes | Yes | Yes | Yes** | Yes | No | No | No | No |
| Copilot User | No | No | No | No | Yes** | Yes (Business Schema only) | No | No | No | No |
| Data Catalog User | No | No | No | No | Yes** | No | No | No | Yes | No |
| Data Governor | No | No | No | No | Yes** | No | No | Yes | Yes | No |
| Schema Manager | No | No | No | No | Yes** | Yes | Yes | Yes | No | No |
| User Manager | No | No | No | No | Yes** | No | No | No | No | Yes |
| SuperRole | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
** Only the SuperRole can see scheduled items. The Scheduler tab is active, but no schedules are shown even when the current user is the sharing target.
*** The Dashboard Analyzer role can personalize dashboards, but cannot create or modify them.
Role exceptions
Several Roles have exceptions or variations of content access. The following are exceptions certain Roles may have.
| Role | Exceptions |
|---|---|
| Individual Analyzer | ● Dashboard sharing control is available in listing view, but the operation is denied. ● The Individual User can not delete dashboards or folders that they do not own. |
| Analyze User | ● Dashboards shared with the Analyze User have editing and advanced menu settings disabled. ● The Analyze User can share with user groups without restriction. |
| Schema Manager | ● Can only see shared data sources, files, and destinations. ● Can load data into shared schemas only with edit permission. ● Can delete non-owned schema objects. |