ReferenceRoles and permissions

Data Hub

Connector definitions, connections, ingestions and runs.

Agentic Friendly

Data Hub combines a tenant functional permission with a relationship on the specific connection or ingestion. Both must allow the operation. Data Steward does not automatically own every connection; Data Credential Manager does not automatically gain operator access to every connection.

Resource relationshipAdditional authority on that resource
ViewerInspect the resource
EditorChange configuration
InvokerTest, discover, use or run, depending on resource type
OperatorReplace connection credentials, manage ingestion schedules or cancel runs
Grant managerManage resource sharing
OwnerAll resource relationships, plus owner-only deletion, state changes and ownership transfer

The permission descriptions identify the required relationship. Run access is checked against the associated ingestion. Connector definitions are tenant-level registrations rather than individually shared connections.

For example, running a shared ingestion requires data.ingestion.run and invoker access to that ingestion, with the required access to its source and destination connections.

Permissions

This family contains 25 permissions. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.

data.connection.create

Create a source or destination connection; the caller becomes its owner.

Create a source or destination connection; the caller becomes its owner.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes
Also impliesdata.connection.list, data.connection.read

data.connection.credential.update

Replace a connection's credentials.

Replace a connection's credentials. Requires operator access; it does not reveal stored secrets or grant general connection-editing rights.

PropertyValue
ScopeSelected tenant
Granted byData Credential Manager
Custom roleYes

data.connection.delete

Delete a connection.

Delete a connection. Requires ownership and remains subject to dependency checks.

PropertyValue
ScopeSelected tenant
Granted byData Steward
Custom roleYes
Also impliesdata.connection.list, data.connection.read, data.connection.update

data.connection.discover

Discover the streams or schema exposed by a connection.

Discover the streams or schema exposed by a connection. Requires invoker access.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes

data.connection.list

List connections visible to the caller in the active tenant.

List connections visible to the caller in the active tenant.

PropertyValue
ScopeSelected tenant
Granted byData Consumer, Data Builder, Data Steward
Custom roleYes
Also impliesdata.connection.read

data.connection.read

Read a connection's non-secret configuration.

Read a connection's non-secret configuration. Requires viewer access to that connection.

PropertyValue
ScopeSelected tenant
Granted byData Consumer, Data Builder, Data Steward
Custom roleYes

data.connection.test

Run a connectivity or configuration check.

Run a connectivity or configuration check. Requires invoker access to the connection.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes

data.connection.update

Edit a connection's configuration.

Edit a connection's configuration. Requires editor access; credential replacement is a separate permission.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes
Also impliesdata.connection.list, data.connection.read

data.connection.use

Use a connection in an ingestion workflow.

Use a connection in an ingestion workflow. Requires invoker access to the connection.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes

data.connector_definition.create

Register a source or target connector definition backed by a runtime image.

Register a source or target connector definition backed by a runtime image.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes
Also impliesdata.connector_definition.list, data.connector_definition.read

data.connector_definition.delete

Delete a connector definition, subject to dependency checks.

Delete a connector definition, subject to dependency checks.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes
Also impliesdata.connector_definition.list, data.connector_definition.read

data.connector_definition.list

List registered connector definitions and their supported capabilities.

List registered connector definitions and their supported capabilities.

PropertyValue
ScopeSelected tenant
Granted byData Consumer, Data Builder, Data Steward
Custom roleYes
Also impliesdata.connector_definition.read

data.connector_definition.read

Inspect a connector definition and its configuration schema.

Inspect a connector definition and its configuration schema.

PropertyValue
ScopeSelected tenant
Granted byData Consumer, Data Builder, Data Steward
Custom roleYes

data.ingestion.create

Create an ingestion definition connecting a source and a destination.

Create an ingestion definition connecting a source and a destination. Access to both connections is checked separately.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes
Also impliesdata.ingestion.list, data.ingestion.read

data.ingestion.delete

Delete an ingestion definition.

Delete an ingestion definition. Requires ownership.

PropertyValue
ScopeSelected tenant
Granted byData Steward
Custom roleYes
Also impliesdata.ingestion.list, data.ingestion.read, data.ingestion.update

data.ingestion.list

List ingestion definitions visible to the caller.

List ingestion definitions visible to the caller.

PropertyValue
ScopeSelected tenant
Granted byData Consumer, Data Builder, Data Steward
Custom roleYes
Also impliesdata.ingestion.read

data.ingestion.read

Inspect an ingestion definition.

Inspect an ingestion definition. Requires viewer access.

PropertyValue
ScopeSelected tenant
Granted byData Consumer, Data Builder, Data Steward
Custom roleYes

data.ingestion.run

Start an ingestion run.

Start an ingestion run. Requires invoker access to the ingestion and appropriate connection access.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes

data.ingestion.schedule.update

Change an ingestion schedule.

Change an ingestion schedule. Requires operator access to the ingestion.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes

data.ingestion.state.reset

Reset the ingestion's saved incremental state.

Reset the ingestion's saved incremental state. Requires ownership and can cause data to be read again.

PropertyValue
ScopeSelected tenant
Granted byData Steward
Custom roleYes

data.ingestion.state.restore

Restore an ingestion state checkpoint.

Restore an ingestion state checkpoint. Requires ownership.

PropertyValue
ScopeSelected tenant
Granted byData Steward
Custom roleYes

data.ingestion.update

Edit an ingestion definition.

Edit an ingestion definition. Requires editor access.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes
Also impliesdata.ingestion.list, data.ingestion.read

data.run.cancel

Cancel an ingestion run.

Cancel an ingestion run. Requires operator access to the associated ingestion.

PropertyValue
ScopeSelected tenant
Granted byData Builder, Data Steward
Custom roleYes
Also impliesdata.run.list, data.run.read

data.run.list

List ingestion-run records visible to the caller.

List ingestion-run records visible to the caller.

PropertyValue
ScopeSelected tenant
Granted byData Consumer, Data Builder, Data Steward
Custom roleYes
Also impliesdata.run.read

data.run.read

Inspect an ingestion run, including its status and available execution details.

Inspect an ingestion run, including its status and available execution details. Requires viewer access to the associated ingestion.

PropertyValue
ScopeSelected tenant
Granted byData Consumer, Data Builder, Data Steward
Custom roleYes

On this page