User roles

Every user has one role in their company. The role is assigned by an administrator when the user is invited and can be changed later from the user list. The role defines the maximum set of operations available to the user across the whole application.

Roles

Role	Purpose
Super administrator	Full access to all companies and system functions. Manages companies, licenses and users at all levels
Administrator	Administers one company — their own: manages users and settings within it. Has access to the audit log, IP filtering and the license
Project manager	May own projects and manage their members. Acts as a developer in the projects they own; in other projects of their company works at the access level assigned to them, which can be lowered to Analyst or Viewer or revoked
Developer	Full access to analytical objects: creates and edits fact tables, data marts, connections and data models
Analyst	Views the RMD, fact tables and the data model and runs the SQL of measures. Creates, edits and deletes data marts and their views in the database, verifies connections. Cannot edit RMD elements, dimension groups, fact tables, relationships, verification filters or connections
Viewer	Views data and generated queries. Cannot create or edit objects

Inside an individual project the role is combined with the user's access level in that project, which can only narrow the permissions the global role grants, never widen them. Project members and access levels are described in the Projects section.

Summary of permissions

Permission	Viewer	Analyst	Developer	Project manager	Administrator	Super administrator
View projects and their content	✅	✅	✅	✅	✅	✅
Generate and view or copy SQL queries	✅	✅	✅	✅	✅	✅
Create and clone projects	❌	❌	❌	✅	✅	✅
Edit and delete projects	❌	❌	❌	own projects	✅	✅
Edit the RMD	❌	❌	✅	✅	✅	✅
Create, edit and delete fact tables	❌	❌	✅	✅	✅	✅
Run the SQL of measures and data marts against the database	❌	✅	✅	✅	✅	✅
Create, edit and delete data marts and their views in the database	❌	✅	✅	✅	✅	✅
Manage update rules, cancel and restart view updates	❌	❌	✅	✅	✅	✅
Verify connections and refresh their schema	❌	✅	✅	✅	✅	✅
Create, edit and delete connections	❌	❌	✅	✅	✅	✅
Manage users	❌	❌	❌	❌	own company	all companies
Manage companies	❌	❌	❌	❌	❌	✅
View the audit log	❌	❌	❌	❌	own company	all companies
Configure IP filtering	❌	❌	❌	❌	own company	all companies
Upload and delete the license	❌	❌	❌	❌	✅	✅

✅ = Allowed | ❌ = Not allowed

Notes:

• Actions unavailable to your role are hidden in the interface, and the same rules are enforced on the server, so a request for a forbidden operation is rejected
• An analyst creates, clones, edits and deletes data marts and manages their views in the database, but cannot edit RMD definitions from the data mart canvas, manage update rules, or cancel and restart view updates
• The Super administrator role cannot be assigned from the user list; it is not offered among the role options
• Data sources, Git connections and identity providers are available only within the user's own company, to a Super administrator as well
• Some operations additionally require a valid license with a free slot, regardless of the role