Best Practices

The following are typical roles and recommended minimum permissions in MatrixOne for you to reference.

Engineer responsible for database resource (user, role, permission) management

Database Administrator

  • Main job functions: manage all configuration information in the tenant, user permissions, backup and recovery, performance tuning, troubleshooting

  • Reference grant role: the default administrator role accountadmin generated when creating a tenant.

  • Refer to granting permissions: user management (CREATE USER, ALTER USER, DROP USER), authority management (MANAGE GRANTS)

Engineer responsible for data management

Data Operation and Maintenance Engineer

  • Main job function: manage all data and metadata information in the tenant, and authorize data permissions

  • Refer to Granting Permissions: Tenant-Level Data Management (ALL ON ACCOUNT)

App Developer

  • Main job function: operate specific databases under the development environment tenant, and have read-only permission from the system tenant

  • Refer to grant permissions: database level data management (ALL ON DATABASE), system database read-only (SELECT ON DATABASE)

Application System Management Engineer

  • Main job function: operate specific databases under the production environment tenant

  • Refer to Granting Permissions: Data Management at the Database Level (ALL ON DATABASE)

System Monitoring Engineer

  • Main job function: monitor all system statistics and error messages under the tenant

  • Refer to grant permissions: read-only permissions for all system databases (SELECT ON DATABASE)