Object access permissions

Permission differentiation in DataLens is implemented at the directory and object level. The available operations depend on what access permissions were assigned.

If you create or copy a directory or object, the permissions for them are inherited from the parent directory at the time of creation or copying. Note that access permissions do not change automatically when you move the objects later.

You can grant users access to a directory or any service object:

• Connection
• Dataset
• Chart
• Dashboard

Permissions can be granted to individual users or the All group that includes users who passed authentication. Users can also request permissions on their own via the request form. For more information, see Requesting permissions.

You can grant the following permissions to objects and directories in DataLens:

• Execute
• Read
• Write
• Admin

ExecuteExecute

A user with the Execute permission for a connection can make requests to it but cannot create datasets. Regardless of the dataset permissions, the user cannot access a list of tables in a dataset or view the SQL subquery the dataset is based on.

A user with the Execute permission for a dataset can run queries against it but cannot create or edit charts or view the dataset.

Granting users the Execute permission allows you to:

• Reduce the number of requests to the source, thereby reducing the load on the connection source.

• Better control what data can be shown from a dataset. You can hide some source fields so that users cannot view all fields.

• Restrict the creation of subqueries to the source database. A user with the Execute permission cannot write subqueries.

ReadRead

A user with the Read permission can view dashboards, widgets, datasets, and directories.

WriteWrite

A user with the Write permission can edit dashboards, widgets, connections, datasets, and directories.

The Write permission includes everything included in the Read permission.

AdminAdmin

A user with the Admin permission can edit available objects and directories, as well as change permissions. The directory administrator can assign permissions for all nested directories and objects.

The Admin permission includes everything included in the Write permission.

Table of permissionsTable of permissions

¹ This feature is only available with the Business service plan.

Object access auditObject access audit

The Business service plan users can get access logs to DataLens objects (view, edit, delete). To get the logs, contact support.

What's nextWhat's next

• Granting and updating permissions
• Deleting permissions
• Requesting permissions