Authorization
Resource grants, grant managers and ownership transfers.
These permissions govern sharing, not system-role assignments. Tenant membership supplies the ordinary sharing-operation gate; ownership or resource-specific sharing authority decides whether it can be used on a particular resource.
Delegating a grant manager or transferring ownership is supported for Data Hub resources and requires both the corresponding permission and current ownership. A grant manager cannot use that role alone to transfer ownership. MCP servers use tenant administration instead of resource sharing; Skills use their own owner-controlled tenant-sharing model.
Permissions
This family contains 5 permissions. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.
authorization.resource_grant.create
Share a supported resource with an eligible subject.
Share a supported resource with an eligible subject. Resource ownership or grant-management authority is still required.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Resource sharing uses baseline membership plus resource-specific grant checks. |
authorization.resource_grant.delegate
Delegate grant-manager access on supported Data Hub resources.
Delegate grant-manager access on supported Data Hub resources. The caller must own the resource.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
authorization.resource_grant.list
Inspect sharing grants on a supported resource when the caller has its sharing or grant-management authority.
Inspect sharing grants on a supported resource when the caller has its sharing or grant-management authority.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Resource sharing uses baseline membership plus resource-specific grant checks. |
authorization.resource_grant.revoke
Remove a sharing grant on a supported resource.
Remove a sharing grant on a supported resource. Independent grants and inherited access remain effective.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Baseline member |
| Custom role | No. Resource sharing uses baseline membership plus resource-specific grant checks. |
authorization.resource_owner.transfer
Transfer ownership of a supported Data Hub resource to an eligible tenant member.
Transfer ownership of a supported Data Hub resource to an eligible tenant member. The caller must be the current owner.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |