# System roles (/docs/reference/roles-permissions/system-roles) Use a system role for a fixed functional bundle, or a custom role for an additive selection of permissions. A system role's definition cannot be edited or deleted. The nine functional roles can be assigned to eligible users and groups within a tenant. Role definitions are not a user's effective access report. A user's permissions combine baseline membership, direct roles, group-inherited roles and custom-role grants. The role permission lists below show only what each role adds above baseline, including inherited role permissions. Resource ownership and sharing checks remain separate. ## Choose a role [#choose-a-role] Expand a definition to inspect its permissions. Functional role IDs are shown beneath their names; administrator assignments and baseline membership are listed separately. ## Administrator boundaries [#administrator-boundaries]
### Platform administrator [#platform-administrator]
Manages the platform tenant registry, protected platform/tenant administrator rosters and shared platform services. It is a protected administrator assignment, not one of the nine functional system roles and not a selectable custom-role permission bundle. Platform administration does not grant membership of every tenant. Global tenant administration is inherited only with current Global membership. Ordinary tenants require their own membership and administrator assignment. Resource services can define explicit administrator access, such as MLflow workspace management; this is not blanket access to all content. | Family | Permission IDs | | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Platform](/docs/reference/roles-permissions/platform) | [platform.admin.assign](/docs/reference/roles-permissions/platform#platformadminassign), [platform.admin.list](/docs/reference/roles-permissions/platform#platformadminlist), [platform.admin.revoke](/docs/reference/roles-permissions/platform#platformadminrevoke), [platform.config.read](/docs/reference/roles-permissions/platform#platformconfigread), [platform.config.update](/docs/reference/roles-permissions/platform#platformconfigupdate), [platform.global.read](/docs/reference/roles-permissions/platform#platformglobalread), [platform.global\_service.manage](/docs/reference/roles-permissions/platform#platformglobal_servicemanage), [platform.tenant.admin.assign](/docs/reference/roles-permissions/platform#platformtenantadminassign), [platform.tenant.admin.list](/docs/reference/roles-permissions/platform#platformtenantadminlist), [platform.tenant.admin.revoke](/docs/reference/roles-permissions/platform#platformtenantadminrevoke), [platform.tenant.create](/docs/reference/roles-permissions/platform#platformtenantcreate), [platform.tenant.delete](/docs/reference/roles-permissions/platform#platformtenantdelete), [platform.tenant.list](/docs/reference/roles-permissions/platform#platformtenantlist), [platform.tenant.read](/docs/reference/roles-permissions/platform#platformtenantread), [platform.tenant.update](/docs/reference/roles-permissions/platform#platformtenantupdate) |
### Tenant administrator [#tenant-administrator]
Manages one tenant's identity, ordinary groups and roles, settings, MCP registrations and other administrator operations. The protected assignment is effective only while the user is a current member of that tenant. This is not a superuser content role. It does not imply the AI, Data or inference functional roles. A tenant administrator who needs those operations also needs the corresponding role or custom-role grant and any resource relationships. In addition to baseline membership, tenant administration grants the following permissions: | Family | Permission IDs | | ----------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Document processing](/docs/reference/roles-permissions/document) | [document.configuration.read](/docs/reference/roles-permissions/document#documentconfigurationread), [document.configuration.update](/docs/reference/roles-permissions/document#documentconfigurationupdate) | | [MCP](/docs/reference/roles-permissions/mcp) | [mcp.server.create](/docs/reference/roles-permissions/mcp#mcpservercreate), [mcp.server.delete](/docs/reference/roles-permissions/mcp#mcpserverdelete), [mcp.server.update](/docs/reference/roles-permissions/mcp#mcpserverupdate) | | [MLflow](/docs/reference/roles-permissions/mlflow) | [mlflow.workspace.create](/docs/reference/roles-permissions/mlflow#mlflowworkspacecreate) | | [Tenant](/docs/reference/roles-permissions/tenant) | [tenant.admin.assign](/docs/reference/roles-permissions/tenant#tenantadminassign), [tenant.admin.list](/docs/reference/roles-permissions/tenant#tenantadminlist), [tenant.admin.revoke](/docs/reference/roles-permissions/tenant#tenantadminrevoke), [tenant.authentication.read](/docs/reference/roles-permissions/tenant#tenantauthenticationread), [tenant.authentication.update](/docs/reference/roles-permissions/tenant#tenantauthenticationupdate), [tenant.branding.read](/docs/reference/roles-permissions/tenant#tenantbrandingread), [tenant.branding.update](/docs/reference/roles-permissions/tenant#tenantbrandingupdate), [tenant.embedding.update](/docs/reference/roles-permissions/tenant#tenantembeddingupdate), [tenant.group.create](/docs/reference/roles-permissions/tenant#tenantgroupcreate), [tenant.group.delete](/docs/reference/roles-permissions/tenant#tenantgroupdelete), [tenant.group.member\_manage](/docs/reference/roles-permissions/tenant#tenantgroupmember_manage), [tenant.group.update](/docs/reference/roles-permissions/tenant#tenantgroupupdate), [tenant.member.add](/docs/reference/roles-permissions/tenant#tenantmemberadd), [tenant.member.create\_local](/docs/reference/roles-permissions/tenant#tenantmembercreate_local), [tenant.member.remove](/docs/reference/roles-permissions/tenant#tenantmemberremove), [tenant.provider.manage](/docs/reference/roles-permissions/tenant#tenantprovidermanage), [tenant.provider.read](/docs/reference/roles-permissions/tenant#tenantproviderread), [tenant.reindex.cancel](/docs/reference/roles-permissions/tenant#tenantreindexcancel), [tenant.reindex.read](/docs/reference/roles-permissions/tenant#tenantreindexread), [tenant.reindex.start](/docs/reference/roles-permissions/tenant#tenantreindexstart), [tenant.role.assign](/docs/reference/roles-permissions/tenant#tenantroleassign), [tenant.role.create](/docs/reference/roles-permissions/tenant#tenantrolecreate), [tenant.role.delete](/docs/reference/roles-permissions/tenant#tenantroledelete), [tenant.role.list](/docs/reference/roles-permissions/tenant#tenantrolelist), [tenant.role.revoke](/docs/reference/roles-permissions/tenant#tenantrolerevoke), [tenant.role.update](/docs/reference/roles-permissions/tenant#tenantroleupdate), [tenant.service.manage](/docs/reference/roles-permissions/tenant#tenantservicemanage), [tenant.service\_desk.update](/docs/reference/roles-permissions/tenant#tenantservice_deskupdate), [tenant.translation.update](/docs/reference/roles-permissions/tenant#tenanttranslationupdate), [tenant.update](/docs/reference/roles-permissions/tenant#tenantupdate) |
## Baseline tenant membership [#baseline-tenant-membership]
Every current tenant member has these **74 operation permissions**, even without a functional role. They cover ordinary personal work, resource-gated content access and tenant context. Having the gate is not the same as owning or being able to see every resource. Custom roles are additive. Removing an identifier from a custom role cannot revoke a permission already supplied by membership, another role or another assignment. | Family | Permission IDs | | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Agents](/docs/reference/roles-permissions/agent) | [agent.configuration.create](/docs/reference/roles-permissions/agent#agentconfigurationcreate), [agent.configuration.delete](/docs/reference/roles-permissions/agent#agentconfigurationdelete), [agent.configuration.list](/docs/reference/roles-permissions/agent#agentconfigurationlist), [agent.configuration.read](/docs/reference/roles-permissions/agent#agentconfigurationread), [agent.configuration.update](/docs/reference/roles-permissions/agent#agentconfigurationupdate), [agent.configuration.use](/docs/reference/roles-permissions/agent#agentconfigurationuse) | | [Authorization and sharing](/docs/reference/roles-permissions/authorization) | [authorization.resource\_grant.create](/docs/reference/roles-permissions/authorization#authorizationresource_grantcreate), [authorization.resource\_grant.list](/docs/reference/roles-permissions/authorization#authorizationresource_grantlist), [authorization.resource\_grant.revoke](/docs/reference/roles-permissions/authorization#authorizationresource_grantrevoke) | | [Chat](/docs/reference/roles-permissions/chat) | [chat.message.create](/docs/reference/roles-permissions/chat#chatmessagecreate), [chat.message.list](/docs/reference/roles-permissions/chat#chatmessagelist), [chat.session.create](/docs/reference/roles-permissions/chat#chatsessioncreate), [chat.session.delete](/docs/reference/roles-permissions/chat#chatsessiondelete), [chat.session.list](/docs/reference/roles-permissions/chat#chatsessionlist), [chat.session.read](/docs/reference/roles-permissions/chat#chatsessionread), [chat.session.update](/docs/reference/roles-permissions/chat#chatsessionupdate) | | [API credentials](/docs/reference/roles-permissions/credential) | [credential.api\_key.create](/docs/reference/roles-permissions/credential#credentialapi_keycreate), [credential.api\_key.list](/docs/reference/roles-permissions/credential#credentialapi_keylist), [credential.api\_key.manage](/docs/reference/roles-permissions/credential#credentialapi_keymanage), [credential.api\_key.revoke](/docs/reference/roles-permissions/credential#credentialapi_keyrevoke) | | [Document processing](/docs/reference/roles-permissions/document) | [document.job.read](/docs/reference/roles-permissions/document#documentjobread), [document.processing.execute](/docs/reference/roles-permissions/document#documentprocessingexecute) | | [MCP](/docs/reference/roles-permissions/mcp) | [mcp.credential.link](/docs/reference/roles-permissions/mcp#mcpcredentiallink), [mcp.credential.status](/docs/reference/roles-permissions/mcp#mcpcredentialstatus), [mcp.credential.unlink](/docs/reference/roles-permissions/mcp#mcpcredentialunlink), [mcp.server.list](/docs/reference/roles-permissions/mcp#mcpserverlist), [mcp.server.read](/docs/reference/roles-permissions/mcp#mcpserverread), [mcp.server.use](/docs/reference/roles-permissions/mcp#mcpserveruse) | | [MLflow](/docs/reference/roles-permissions/mlflow) | [mlflow.webhook.create](/docs/reference/roles-permissions/mlflow#mlflowwebhookcreate), [mlflow.webhook.delete](/docs/reference/roles-permissions/mlflow#mlflowwebhookdelete), [mlflow.webhook.list](/docs/reference/roles-permissions/mlflow#mlflowwebhooklist), [mlflow.webhook.read](/docs/reference/roles-permissions/mlflow#mlflowwebhookread), [mlflow.webhook.update](/docs/reference/roles-permissions/mlflow#mlflowwebhookupdate), [mlflow.workspace.delete](/docs/reference/roles-permissions/mlflow#mlflowworkspacedelete), [mlflow.workspace.list](/docs/reference/roles-permissions/mlflow#mlflowworkspacelist), [mlflow.workspace.read](/docs/reference/roles-permissions/mlflow#mlflowworkspaceread), [mlflow.workspace.update](/docs/reference/roles-permissions/mlflow#mlflowworkspaceupdate) | | [Deep Research](/docs/reference/roles-permissions/research) | [research.job.cancel](/docs/reference/roles-permissions/research#researchjobcancel), [research.job.control](/docs/reference/roles-permissions/research#researchjobcontrol), [research.job.create](/docs/reference/roles-permissions/research#researchjobcreate), [research.job.delete](/docs/reference/roles-permissions/research#researchjobdelete), [research.job.list](/docs/reference/roles-permissions/research#researchjoblist), [research.job.read](/docs/reference/roles-permissions/research#researchjobread) | | [Skills](/docs/reference/roles-permissions/skill) | [skill.create](/docs/reference/roles-permissions/skill#skillcreate), [skill.delete](/docs/reference/roles-permissions/skill#skilldelete), [skill.read](/docs/reference/roles-permissions/skill#skillread), [skill.share](/docs/reference/roles-permissions/skill#skillshare), [skill.update](/docs/reference/roles-permissions/skill#skillupdate) | | [Spark](/docs/reference/roles-permissions/spark) | [spark.cluster.create](/docs/reference/roles-permissions/spark#sparkclustercreate), [spark.cluster.delete](/docs/reference/roles-permissions/spark#sparkclusterdelete), [spark.cluster.list](/docs/reference/roles-permissions/spark#sparkclusterlist), [spark.cluster.read](/docs/reference/roles-permissions/spark#sparkclusterread), [spark.cluster.scale](/docs/reference/roles-permissions/spark#sparkclusterscale), [spark.job.create](/docs/reference/roles-permissions/spark#sparkjobcreate), [spark.job.delete](/docs/reference/roles-permissions/spark#sparkjobdelete), [spark.job.list](/docs/reference/roles-permissions/spark#sparkjoblist), [spark.job.read](/docs/reference/roles-permissions/spark#sparkjobread) | | [Files and storage](/docs/reference/roles-permissions/storage) | [storage.object.create](/docs/reference/roles-permissions/storage#storageobjectcreate), [storage.object.delete](/docs/reference/roles-permissions/storage#storageobjectdelete), [storage.object.download](/docs/reference/roles-permissions/storage#storageobjectdownload), [storage.object.list](/docs/reference/roles-permissions/storage#storageobjectlist), [storage.object.read](/docs/reference/roles-permissions/storage#storageobjectread), [storage.object.update](/docs/reference/roles-permissions/storage#storageobjectupdate), [storage.space.create](/docs/reference/roles-permissions/storage#storagespacecreate), [storage.space.delete](/docs/reference/roles-permissions/storage#storagespacedelete), [storage.space.list](/docs/reference/roles-permissions/storage#storagespacelist), [storage.space.read](/docs/reference/roles-permissions/storage#storagespaceread), [storage.space.update](/docs/reference/roles-permissions/storage#storagespaceupdate) | | [Tenant](/docs/reference/roles-permissions/tenant) | [tenant.embedding.read](/docs/reference/roles-permissions/tenant#tenantembeddingread), [tenant.group.list](/docs/reference/roles-permissions/tenant#tenantgrouplist), [tenant.member.list](/docs/reference/roles-permissions/tenant#tenantmemberlist), [tenant.service\_desk.read](/docs/reference/roles-permissions/tenant#tenantservice_deskread), [tenant.read](/docs/reference/roles-permissions/tenant#tenantread), [tenant.translation.read](/docs/reference/roles-permissions/tenant#tenanttranslationread) |
## AI Viewer [#ai-viewer] assigned_ai_viewer
Inspect MLflow experiments, runs, models and traces without granting their write operations. Adds these **8 permissions** above baseline: | Family | Permission IDs | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [MLflow](/docs/reference/roles-permissions/mlflow) | [mlflow.experiment.list](/docs/reference/roles-permissions/mlflow#mlflowexperimentlist), [mlflow.experiment.read](/docs/reference/roles-permissions/mlflow#mlflowexperimentread), [mlflow.model.list](/docs/reference/roles-permissions/mlflow#mlflowmodellist), [mlflow.model.read](/docs/reference/roles-permissions/mlflow#mlflowmodelread), [mlflow.run.list](/docs/reference/roles-permissions/mlflow#mlflowrunlist), [mlflow.run.read](/docs/reference/roles-permissions/mlflow#mlflowrunread), [mlflow.trace.list](/docs/reference/roles-permissions/mlflow#mlflowtracelist), [mlflow.trace.read](/docs/reference/roles-permissions/mlflow#mlflowtraceread) |
## AI Builder [#ai-builder] assigned_ai_builder
Create and manage MLflow experiments, runs, models and traces. Includes AI Viewer permissions, but not platform model deployment or automatic workspace creation. Adds these **20 permissions** above baseline: | Family | Permission IDs | | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [MLflow](/docs/reference/roles-permissions/mlflow) | [mlflow.experiment.create](/docs/reference/roles-permissions/mlflow#mlflowexperimentcreate), [mlflow.experiment.delete](/docs/reference/roles-permissions/mlflow#mlflowexperimentdelete), [mlflow.experiment.list](/docs/reference/roles-permissions/mlflow#mlflowexperimentlist), [mlflow.experiment.read](/docs/reference/roles-permissions/mlflow#mlflowexperimentread), [mlflow.experiment.update](/docs/reference/roles-permissions/mlflow#mlflowexperimentupdate), [mlflow.model.create](/docs/reference/roles-permissions/mlflow#mlflowmodelcreate), [mlflow.model.delete](/docs/reference/roles-permissions/mlflow#mlflowmodeldelete), [mlflow.model.list](/docs/reference/roles-permissions/mlflow#mlflowmodellist), [mlflow.model.promote](/docs/reference/roles-permissions/mlflow#mlflowmodelpromote), [mlflow.model.read](/docs/reference/roles-permissions/mlflow#mlflowmodelread), [mlflow.model.update](/docs/reference/roles-permissions/mlflow#mlflowmodelupdate), [mlflow.run.create](/docs/reference/roles-permissions/mlflow#mlflowruncreate), [mlflow.run.delete](/docs/reference/roles-permissions/mlflow#mlflowrundelete), [mlflow.run.list](/docs/reference/roles-permissions/mlflow#mlflowrunlist), [mlflow.run.read](/docs/reference/roles-permissions/mlflow#mlflowrunread), [mlflow.run.update](/docs/reference/roles-permissions/mlflow#mlflowrunupdate), [mlflow.trace.delete](/docs/reference/roles-permissions/mlflow#mlflowtracedelete), [mlflow.trace.list](/docs/reference/roles-permissions/mlflow#mlflowtracelist), [mlflow.trace.read](/docs/reference/roles-permissions/mlflow#mlflowtraceread), [mlflow.trace.update](/docs/reference/roles-permissions/mlflow#mlflowtraceupdate) |
## Data Consumer [#data-consumer] assigned_data_consumer
Discover connector definitions and inspect Data Hub resources shared with the caller. Adds these **8 permissions** above baseline: | Family | Permission IDs | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [Data Hub](/docs/reference/roles-permissions/data) | [data.connection.list](/docs/reference/roles-permissions/data#dataconnectionlist), [data.connection.read](/docs/reference/roles-permissions/data#dataconnectionread), [data.connector\_definition.list](/docs/reference/roles-permissions/data#dataconnector_definitionlist), [data.connector\_definition.read](/docs/reference/roles-permissions/data#dataconnector_definitionread), [data.ingestion.list](/docs/reference/roles-permissions/data#dataingestionlist), [data.ingestion.read](/docs/reference/roles-permissions/data#dataingestionread), [data.run.list](/docs/reference/roles-permissions/data#datarunlist), [data.run.read](/docs/reference/roles-permissions/data#datarunread) |
## Data Builder [#data-builder] assigned_data_builder
Register connector definitions, create and operate connections and ingestions, and delegate sharing on owned Data Hub resources. Includes Data Consumer permissions. Does not grant connection deletion or credential replacement. Adds these **22 permissions** above baseline: | Family | Permission IDs | | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Authorization and sharing](/docs/reference/roles-permissions/authorization) | [authorization.resource\_grant.delegate](/docs/reference/roles-permissions/authorization#authorizationresource_grantdelegate), [authorization.resource\_owner.transfer](/docs/reference/roles-permissions/authorization#authorizationresource_ownertransfer) | | [Data Hub](/docs/reference/roles-permissions/data) | [data.connection.create](/docs/reference/roles-permissions/data#dataconnectioncreate), [data.connection.discover](/docs/reference/roles-permissions/data#dataconnectiondiscover), [data.connection.list](/docs/reference/roles-permissions/data#dataconnectionlist), [data.connection.read](/docs/reference/roles-permissions/data#dataconnectionread), [data.connection.test](/docs/reference/roles-permissions/data#dataconnectiontest), [data.connection.update](/docs/reference/roles-permissions/data#dataconnectionupdate), [data.connection.use](/docs/reference/roles-permissions/data#dataconnectionuse), [data.connector\_definition.create](/docs/reference/roles-permissions/data#dataconnector_definitioncreate), [data.connector\_definition.delete](/docs/reference/roles-permissions/data#dataconnector_definitiondelete), [data.connector\_definition.list](/docs/reference/roles-permissions/data#dataconnector_definitionlist), [data.connector\_definition.read](/docs/reference/roles-permissions/data#dataconnector_definitionread), [data.ingestion.create](/docs/reference/roles-permissions/data#dataingestioncreate), [data.ingestion.list](/docs/reference/roles-permissions/data#dataingestionlist), [data.ingestion.read](/docs/reference/roles-permissions/data#dataingestionread), [data.ingestion.run](/docs/reference/roles-permissions/data#dataingestionrun), [data.ingestion.schedule.update](/docs/reference/roles-permissions/data#dataingestionscheduleupdate), [data.ingestion.update](/docs/reference/roles-permissions/data#dataingestionupdate), [data.run.cancel](/docs/reference/roles-permissions/data#dataruncancel), [data.run.list](/docs/reference/roles-permissions/data#datarunlist), [data.run.read](/docs/reference/roles-permissions/data#datarunread) |
## Data Steward [#data-steward] assigned_data_steward
Data Builder access plus connection/ingestion deletion and ingestion state reset/restore. Resource ownership is still required for those operations. Does not include Data Credential Manager. Adds these **26 permissions** above baseline: | Family | Permission IDs | | ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Authorization and sharing](/docs/reference/roles-permissions/authorization) | [authorization.resource\_grant.delegate](/docs/reference/roles-permissions/authorization#authorizationresource_grantdelegate), [authorization.resource\_owner.transfer](/docs/reference/roles-permissions/authorization#authorizationresource_ownertransfer) | | [Data Hub](/docs/reference/roles-permissions/data) | [data.connection.create](/docs/reference/roles-permissions/data#dataconnectioncreate), [data.connection.delete](/docs/reference/roles-permissions/data#dataconnectiondelete), [data.connection.discover](/docs/reference/roles-permissions/data#dataconnectiondiscover), [data.connection.list](/docs/reference/roles-permissions/data#dataconnectionlist), [data.connection.read](/docs/reference/roles-permissions/data#dataconnectionread), [data.connection.test](/docs/reference/roles-permissions/data#dataconnectiontest), [data.connection.update](/docs/reference/roles-permissions/data#dataconnectionupdate), [data.connection.use](/docs/reference/roles-permissions/data#dataconnectionuse), [data.connector\_definition.create](/docs/reference/roles-permissions/data#dataconnector_definitioncreate), [data.connector\_definition.delete](/docs/reference/roles-permissions/data#dataconnector_definitiondelete), [data.connector\_definition.list](/docs/reference/roles-permissions/data#dataconnector_definitionlist), [data.connector\_definition.read](/docs/reference/roles-permissions/data#dataconnector_definitionread), [data.ingestion.create](/docs/reference/roles-permissions/data#dataingestioncreate), [data.ingestion.delete](/docs/reference/roles-permissions/data#dataingestiondelete), [data.ingestion.list](/docs/reference/roles-permissions/data#dataingestionlist), [data.ingestion.read](/docs/reference/roles-permissions/data#dataingestionread), [data.ingestion.run](/docs/reference/roles-permissions/data#dataingestionrun), [data.ingestion.schedule.update](/docs/reference/roles-permissions/data#dataingestionscheduleupdate), [data.ingestion.state.reset](/docs/reference/roles-permissions/data#dataingestionstatereset), [data.ingestion.state.restore](/docs/reference/roles-permissions/data#dataingestionstaterestore), [data.ingestion.update](/docs/reference/roles-permissions/data#dataingestionupdate), [data.run.cancel](/docs/reference/roles-permissions/data#dataruncancel), [data.run.list](/docs/reference/roles-permissions/data#datarunlist), [data.run.read](/docs/reference/roles-permissions/data#datarunread) |
## Data Credential Manager [#data-credential-manager] assigned_data_credential_manager
Replace connection credentials independently of data-building roles. Operator access on the connection is also required; the role alone does not provide Data Hub discovery permissions. Adds this **1 permission** above baseline: | Family | Permission IDs | | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | | [Data Hub](/docs/reference/roles-permissions/data) | [data.connection.credential.update](/docs/reference/roles-permissions/data#dataconnectioncredentialupdate) |
## Inference Consumer [#inference-consumer] assigned_inference_consumer
The built-in inference-consumer assignment adds no permission IDs beyond baseline tenant membership in this catalogue. Do not infer deployment authority from the role name. Tenant membership still supplies baseline access; this role adds no catalogue permissions.
## Inference Deployer [#inference-deployer] assigned_inference_deployer
Manage tenant model presets and allowed runtime profiles, and inspect shared catalogues. Does not grant the platform-wide model-installer permission. Adds these **13 permissions** above baseline: | Family | Permission IDs | | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Platform](/docs/reference/roles-permissions/platform) | [platform.model\_preset.list](/docs/reference/roles-permissions/platform#platformmodel_presetlist), [platform.model\_preset.read](/docs/reference/roles-permissions/platform#platformmodel_presetread), [platform.runtime\_profile.read](/docs/reference/roles-permissions/platform#platformruntime_profileread) | | [Tenant](/docs/reference/roles-permissions/tenant) | [tenant.model\_preset.create](/docs/reference/roles-permissions/tenant#tenantmodel_presetcreate), [tenant.model\_preset.delete](/docs/reference/roles-permissions/tenant#tenantmodel_presetdelete), [tenant.model\_preset.list](/docs/reference/roles-permissions/tenant#tenantmodel_presetlist), [tenant.model\_preset.read](/docs/reference/roles-permissions/tenant#tenantmodel_presetread), [tenant.model\_preset.update](/docs/reference/roles-permissions/tenant#tenantmodel_presetupdate), [tenant.runtime\_profile.create](/docs/reference/roles-permissions/tenant#tenantruntime_profilecreate), [tenant.runtime\_profile.delete](/docs/reference/roles-permissions/tenant#tenantruntime_profiledelete), [tenant.runtime\_profile.list](/docs/reference/roles-permissions/tenant#tenantruntime_profilelist), [tenant.runtime\_profile.read](/docs/reference/roles-permissions/tenant#tenantruntime_profileread), [tenant.runtime\_profile.update](/docs/reference/roles-permissions/tenant#tenantruntime_profileupdate) |
## Inference Operator [#inference-operator] assigned_inference_operator
Inspect tenant model presets, allowed runtime profiles and shared catalogues. Does not grant profile writes or platform model deployment. Adds these **7 permissions** above baseline: | Family | Permission IDs | | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Platform](/docs/reference/roles-permissions/platform) | [platform.model\_preset.list](/docs/reference/roles-permissions/platform#platformmodel_presetlist), [platform.model\_preset.read](/docs/reference/roles-permissions/platform#platformmodel_presetread), [platform.runtime\_profile.read](/docs/reference/roles-permissions/platform#platformruntime_profileread) | | [Tenant](/docs/reference/roles-permissions/tenant) | [tenant.model\_preset.list](/docs/reference/roles-permissions/tenant#tenantmodel_presetlist), [tenant.model\_preset.read](/docs/reference/roles-permissions/tenant#tenantmodel_presetread), [tenant.runtime\_profile.list](/docs/reference/roles-permissions/tenant#tenantruntime_profilelist), [tenant.runtime\_profile.read](/docs/reference/roles-permissions/tenant#tenantruntime_profileread) |
## Inspect deployed role definitions [#inspect-deployed-role-definitions] `GET /v1/authz/roles?kind=system` returns system-role definitions and direct assignments in `roles`, plus membership-derived permissions in `baseline_permissions`. Each system role lists only its additions above baseline, including inherited role permissions. The baseline list is returned even with `kind=custom`; it is not an assignable role. `GET /v1/authz/roles/{role_id}` reads one role. Both require `tenant.role.list`. For example, use `assigned_data_builder` as the role ID, not the display label “Data Builder”. Custom roles use UUIDs. The response's permission list is a role definition, not proof that a particular user can access a particular resource. ## Related pages [#related-pages] * [Roles and permissions catalogue](/docs/reference/roles-permissions) * [Tenant settings](/docs/administration/tenant-settings) * [Access and tenant context](/docs/use/api#tenant-selection)