Authorization¶
Authorization is a core concept in the MatrixOne Intelligence product model. This page explains the problems it solves, its relationships with other objects, and its usage boundaries.
Definition¶
AI Studio authorization combines workspace membership, roles, actions, and resource scope.
MatrixOne authorization uses database users, roles, and SQL object grants.
The systems are independent; a workspace role does not automatically grant database privileges.
Object relationships¶
Account identity first determines who the user is, while membership determines whether the user can enter the workspace.
Effective roles and resource grants determine whether reading, using, creating, updating, or deleting is allowed.
Authorization validation must test both allowed and denied paths and remain fail-closed when dependent services are unavailable.
Design principles¶
Use least privilege and keep credentials in managed configuration.
Start by validating with minimal data or test objects, then expand the scope.
Version executable configuration and retain each run as an execution record.
Do not equate a visible entry with backend availability or resource authorization.
Note
These pages follow the current MOI 5.0 product model. If an entry is missing, check the workspace, permissions, and feature flags.