Role-based access control (RBAC)

### Administrative permissions[​](#administrative-permissions "Direct link to Administrative permissions")

In addition to resource permissions, each role includes two administrative settings:

- **Users** (No Access · Limited Access) — controls whether the role can view team members and their roles. Only Admins can invite, remove, or update users.
- **Team** (Read · Manage) — controls whether the role can view or modify team-level settings such as security policies and RBAC configuration.

### Fine-grained access rules[​](#fine-grained-access-rules "Direct link to Fine-grained access rules")

Dashboards, Saved Searches, Sources, and Notebooks support fine-grained controls that restrict access to individual resources within a category. Use these when you need to limit a role to specific resources rather than granting blanket access to the entire resource type.

#### Default access vs. fine-grained controls[​](#access-control-modes "Direct link to Default access vs. fine-grained controls")

Each resource type has an **Access Control Mode**:

- **Default Access** — applies a single access level (No Access, Read, or Manage) to all resources of that type.
- **Fine-Grained Controls** — lets you define access rules that match specific resources by condition. Resources that don't match any rule default to no access.

To switch modes, click the chevron to expand a resource type in the role editor, then toggle the **Access Control Mode**.

#### Configuring access rules[​](#configuring-access-rules "Direct link to Configuring access rules")

Each access rule consists of a **condition** and an **access level**. Conditions match resources by their properties:

|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Condition field Operators What it matches Example|  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | **Name** `is`, `contains` The display name of the resource — for example, the dashboard title. Name contains `production` — matches any dashboard with "production" in its title.| **Tag** `is`, `contains` Tags assigned to the resource via the tag panel in the top-right corner of the resource view. Available for Dashboards, Saved Searches, and Notebooks only. Tag is `critical` — matches resources tagged "critical."| **ID** `is`, `contains` The resource identifier, found in the URL bar when you open the resource. ID is `abc123` — matches a single specific resource. | | | | | | | | | | | | | | | |

The following screenshot shows both the dashboard ID highlighted in the URL bar and a "TESTING" tag visible in the tag panel (top-right).

You can add multiple rules per resource type. Each rule is checked independently using OR logic — a resource is accessible if it matches **any** rule. Resources that don't match any rule aren't accessible.

**Example**: To give a role read-only access to testing dashboards, expand Dashboards, switch to Fine-Grained Controls, and add two rules:

- **Name** `contains` `testing` with access level **Read**
- **Tag** `is` `testing` with access level **Read**

A dashboard that matches either rule is accessible.

## Security policies[​](#security-policies "Direct link to Security policies")

The **Security Policies** section in **Team Settings** provides additional controls.

**Default New User Role** sets the role automatically assigned to new users who join the team.

**Generative AI** lets you enable or disable LLM-powered features (such as natural language query generation) powered by Anthropic or Amazon Bedrock. When disabled, no data is sent to AI providers.

- [User access prerequisites](#user-access-prerequisites)- [Built-in roles](#built-in-roles)- [Assigning roles to team members](#assigning-roles)- [Creating a custom role](#creating-a-role)- [Role permissions](#role-permissions)- [Security policies](#security-policies)

Was this page helpful?