Permissions and Audit Logs

The MOI SDK models authorization through global privilege codes and object-level privileges assigned to roles. It also exposes user-change and role-change logs. Privilege codes are the programmatic identifiers: for example, DC2 queries a catalog and DT8 reads table data. See the AI Studio permission matrix for the product-level mapping.

Role and privilege methods

Goal	Python	Go
Create, read, list, or delete roles	create_role, get_role, list_roles, delete_role	CreateRole, GetRole, ListRoles, DeleteRole
Replace role privileges and description	update_role_info	UpdateRoleInfo
Update codes for an object and category	update_role_code_list	UpdateRoleCodeList
Enable or disable a role	update_role_status	UpdateRoleStatus
Find roles attached to an object	list_roles_by_category_and_object	ListRolesByCategoryAndObject
Replace roles attached to an object	update_roles_by_object	UpdateRolesByObject
List objects eligible for grants	list_objects_by_category	ListObjectsByCategory

Python’s SDKClient also supplies table-oriented helpers such as create_table_role, update_table_role, and delete_table_role. They encapsulate a multi-step table-role workflow. Use RawClient for general roles and other object categories.

Read roles before changing them

Python

roles = client.list_roles(
    {
        "keyword": "reader",
        "common_condition": {
            "page": 1,
            "page_size": 50,
            "filters": [],
        },
    }
)

for role in roles["role_list"]:
    print(role["id"], role["name"], role["status"])

Go

roles, err := client.ListRoles(ctx, &sdk.RoleListRequest{
	Keyword: "reader",
	CommonCondition: sdk.CommonCondition{
		Page:     1,
		PageSize: 50,
		Filters:  []sdk.CommonFilter{},
	},
})
if err != nil {
	return err
}

for _, role := range roles.List {
	fmt.Println(role.RoleID, role.RoleName, role.Status)
}

get_role and GetRole return the global authority_list and object-level obj_authority_list. Create and update requests use authority_code_list and obj_authority_code_list.

Global and object privileges

A global grant is a list of privilege codes. An object grant additionally identifies the object, its category, and optional rules for each code. This example creates a role with one global read privilege:

created = client.create_role(
    {
        "name": "catalog_reader",
        "description": "Can list catalogs",
        "authority_code_list": ["DC2"],
        "obj_authority_code_list": [],
    }
)

Object IDs and categories must come from the service. Use list_objects_by_category({"category": "catalog"}) to discover grantable objects. The current Python integration test and Go typed model use different JSON names for the nested object identifier and category. Until the SDK versions converge, use the request model and tests shipped with the installed version rather than copying an object-grant payload across languages.

update_role_info and UpdateRoleInfo accept complete global and object privilege lists. Updating from a stale snapshot can overwrite another administrator’s change. Read the role again, merge the desired state, submit it, and verify the resulting details.

AI Studio workspace roles and MatrixOne database roles are independent. A privilege code does not replace SQL GRANT, and a database grant does not add Catalog Service privileges.

User and role logs

The SDK exposes two administrative log streams:

Log	Python	Go	Coverage
User logs	list_user_logs(request)	ListUserLogs(ctx, req)	User creation, updates, deletion, role assignment, and related changes
Role logs	list_role_logs(request)	ListRoleLogs(ctx, req)	Role creation, updates, deletion, and privilege changes

Both take the common paging and filtering structure. Entries include operation type, user name, role name, creation time, status, and description:

logs = client.list_role_logs(
    {
        "keyword": "",
        "common_condition": {
            "page": 1,
            "page_size": 50,
            "filters": [],
        },
    }
)

These are user and role administration logs, not a general audit stream for every Catalog request. The AI Studio Operation Logs page can show method, path, status, and request ID for requests made by the current signed-in user. The public SDK does not currently expose an equivalent general operation-log method.

Correlate calls and errors

Both SDKs can attach an X-Request-ID to an individual call:

from moi.options import with_request_id

client.get_role(
    {"id": 401},
    with_request_id("iam-read-role-401"),
)

role, err := client.GetRole(
	ctx,
	&sdk.RoleInfoRequest{RoleID: 401},
	sdk.WithRequestID("iam-read-role-401"),
)

Service-envelope errors are APIError in Python and *sdk.APIError in Go; they carry a code, message, request ID, and HTTP status. A non-2xx response that cannot be handled as an API envelope is an HTTPError. Record the request ID and non-sensitive object identifiers, but not API keys, passwords, or complete sensitive bodies.

For product role configuration, see Role Permissions. For the console log boundary, see Operation Logs.