Role Permissions¶

A role is a reusable set of AI Studio feature permissions. After a role is assigned to a workspace member, that member can use the corresponding features in the current workspace according to the role’s configuration.

A member can be associated with multiple roles. For managing members and assigning roles, see User Management.

Role list and operations¶

Open User Permissions > Role Permissions to view and search for roles in the current workspace. Depending on the permissions of the current operator, the role page provides the following actions.

Operation	Purpose
Create role	Create a role from a blank configuration or begin with an existing role
Modify	Change the role name, description, and permission configuration
View permissions	View the role’s current permissions
Inherit	Manage inheritance and grant relationships between roles
Enable/Disable	Change whether the role is available
Delete	Delete a role that is no longer needed after confirmation
Logs	View operation records related to the role

The system-reserved super administrator role cannot be modified, inherited, enabled, disabled, or deleted.

Create, copy, and edit a role¶

When creating a role, you can start from a blank configuration or from an existing role. Starting from an existing role is useful for reusing a permission set for a similar responsibility and then adjusting the differences.

Click Create Role in the role list.
Choose to create from a blank configuration or select an existing role as the starting point.
Enter a role name and description.
Configure the role under Global Permissions and Object Permissions.
After saving, assign the role to the relevant members under User Management.

To modify an existing role, similarly adjust its name, description, and permissions in the role editor. Changes to a role’s configuration affect the members associated with that role in the current workspace. Confirm the scope of impact before saving.

Configure permissions¶

The role editor divides permissions into Global Permissions and Object Permissions tabs. Not every permission supports an object scope; only items displayed on the Object Permissions tab let you select specific objects.

Scope	Usage
Global permissions	Grant workspace-level feature operations, such as managing a category of features or using a platform capability
Object permissions	Grant permissions for selectable objects, such as setting an operable scope for specific connectors, data assets, or other resources

The current role editor organizes permission items by functional domain. It covers connectors, load tasks, export tasks, workflows, SQL Editor and History, jobs, alerts, users, roles, Catalog, databases, volumes, tables, custom operators, models, compute resources, knowledge bases, publishing, subscriptions, and other capabilities.

Where applicable, table-related object permissions also provide row- and column-level configuration. The specific available objects and operations vary with the functional domain, resource type, and product version. Refer to the role editor for the options currently displayed.

Role inheritance and grants¶

Role relationships reuse permission configurations; they do not directly issue temporary permissions to an individual user. Under a role’s Inherit action, you can view and maintain three types of information.

Tab	Meaning
Inherited from	Other roles from which the current role inherits permissions
Granted to	Other roles to which the current role grants its permissions
Relationship graph	A graphical view of relationships between roles

When creating or removing a relationship, first select and confirm the target role. After modifying a role relationship, recheck the permissions of the affected roles to avoid unexpectedly expanding or reducing the capabilities available to members.

Here, “grant” manages relationships between roles. It is not equivalent to the MatrixOne SQL GRANT statement and should not be interpreted as the legacy WITH GRANT OPTION or Owner-transfer process.

Enable, delete, and view logs¶

Before disabling a role, check whether associated members have other roles that allow them to complete their current work. Before deleting a role, confirm that the role and its permission set are no longer needed, and check the role assignments of affected members.

Deleting a role requires a second confirmation. Deletion and status changes are important permission adjustments. After making such a change, verify that member roles and related workspace features behave as expected.

Click Logs in the role’s operation column to view operation records for the role. Use these records to audit changes to role creation, modification, status, and relationships.

Boundary with MatrixOne permissions¶

Roles on this page control only AI Studio workspace features. Manage MatrixOne database users, database roles, object permissions, and SQL grants separately under MatrixOne Permissions.