References → Security Roles

About Security Roles

A user belongs to zero or more Groups, and a Group is assigned to zero or more Roles. Roles are immutable. You cannot create, edit, or delete a Role. Groups, Security Roles, and Users are managed in the Security Manager.

Security Model

Incorta's security model is optimistic, meaning that Incorta enforces the least restrictive role permissions and access rights. All users inherit the User role. A tenant administrator inherits the SuperRole by default. There is no direct way to assign a role to user. Instead, you can assign one or more Roles to a Group. A Group is a collection of zero or more users. You assign a user to one or more groups.

Role Based Access Control

Role Based Access Control (RBAC) enforces access to certain features and functionality within the Incorta Analytics Services. The Incorta Loader Services is not accessible. The Incorta Cluster Management console is a separate web interface, and is enabled for a single administrator user.

There is no direct way to assign a Role to a user, with two exceptions:

All users inherit the User role
A tenant administrator inherits the SuperRole role unless otherwise configured for the tenant

Role Descriptions

Role	Role Type	Description
User	User Role	Can view, favorite, apply filters, and create bookmarks in dashboards that are shared with them. Can hide the tab and filter bars when viewing a dashboard. The default role assigned to a user.
Privileged User	User Role	Can share dashboards and folders, and publish dashboards via email and schedules.
Dashboard Analyzer	User Role	Can personalize, share, and publish dashboards via email and schedules.
Individual Analyzer	User Role	Can create and modify dashboards. Can personalize dashboards. Can create and modify folders. Can access Analyzer. Cannot share dashboards or folders.
Analyze User	User Role	Can create and modify dashboards. Can personalize dashboards. Can create and modify folders. Can access Analyzer. Can share dashboards and folders, and publish dashboards via email and schedules.
Schema Manager	Admin Role	Can create and modify schemas, business schemas, data connections and data destinations. Can load data. Can share schemas with other users and groups.
User Manager	Admin Role	Can create and modify groups and users. Can add roles and users to groups.
SuperRole	Super Role	Has full access to all permissions. Note: Users with the SuperRole role or the Super User can view only dashboards and folders that they own or have access rights to.

Important

You can limit users with "User" or "Individual User" roles to not to download insights. You can do that by disabling the Download insights option found under Default Tenant Configurations > Security in the Cluster Management Console (CMC).

Role Permissions

There are four levels of permissions a Role might have for different content uses of Incorta. In descending order a Role can: Manage, Share, View, or have no permissions. Having a higher level of permission access grants the permission of the lower levels.

Role	Catalog (Content)	Schema	Security	Data Connection	Data Destination
User	View
Privileged User	Share
Dashboard Analyzer	Share
Individual Analyzer	Manage*	View			View
Analyze User	Manage	View			View
Schema Manager		Manage		Manage	Manage
User Manager			Manage
SuperRole	Manage	Manage	Manage	Manage	Manage

Note

Note that Catalog refers to the Content tab in the Navigation bar.

Note

The Individual Analyzer can manage the Catalog (Content), but can not share.

Important

Starting with the 2021.4.3 release, users with only the Analyze User or Individual Analyzer roles will have limited access to the Business Schema Manager where they can view a list of business schemas shared with them without the need to be assigned the Schema Manager role. They can only open a shared business schema in the Business Schema Designer view mode, explore its data, export it, and view its description and sharing configurations.

Important: User Permissions

Permissions in Incorta are determined by a combination of assigned roles and access rights granted when sharing objects. Together, these factors define the functionalities and features available to users.

For example:

If a user, Joe, belongs only to a group with the User role, which only permits viewing access to the Catalog (Content Manager), and another user, Tom, grants Joe edit rights to a dashboard, Joe can only view the dashboard.
Similarly, if Joe belongs to a group with the Analyze User role, which allows users to manage the Catalog, and Tom grants Joe view access to a dashboard, Joe will be restricted to viewing the dashboard.

Role Content Access

Role	Dashboard Create / Modify	Personalize Dashboards	Manage Folders	Share / Publish	Analyzer	Scheduler	Schema / Bus Schema	Data	Security
User	No	No	No	No	No	Yes**	No	No	No
Privileged User	No	No	No	Yes	No	Yes**	No	No	No
Dashboard Analyzer	No	Yes	No	Yes	No	Yes**	No	No	No
Individual Analyzer	Yes	Yes	Yes	No	Yes	Yes**	No	No	No
Analyze User	Yes	Yes	Yes	Yes	Yes	Yes**	No	No	No
Schema Manager	No	No	No	No	No	Yes**	Yes	Yes	No
User Manager	No	No	No	No	No	Yes**	No	No	Yes
SuperRole	All	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes

Note on Scheduler access

** Only the SuperRole can see scheduled items. The Scheduler tab is active, but no schedules are shown even when the current user is the sharing target.

Role Exceptions

Several Roles have exceptions or variations of content access. Following are exceptions certain Roles may have.

Role	Exceptions
Individual Analyzer	Dashboard sharing control shown in listing view, but operation is denied. The Individual User can not delete dashboards or folders they do not own.
Analyze User	Dashboards shared with the Analyze User have editing and advanced menu settings disabled. Note: The Analyze User can share with user groups without restriction.
Schema Manager	Can only see shared data sources, files, and destinations. Can load data into shared schemas only with edit permission. Can delete non-owned schema objects.

Content