Connection permissions

Whether an operation on a connection is allowed is determined by the workspace role, plus the access level and resource role.

• Access level determines who can use the connection.
• Resource role determines which operations are allowed within that scope.

For example, for a connection with an access level of Protected, only users and groups granted a permission can use the connection. Within that group, a Connection User is allowed to run SQL and view the results, while a Connection Viewer is only allowed to view the results.

For a feature overview, see Connection.

Access level

Access level	Description
Workspace	Members in the workspace can access it according to their workspace role
Protected	Only users and groups granted a resource role can access it. The Workspace Owner can edit the connection's permissions
Private	Only users and groups granted a resource role can access it. Even the Workspace Owner can't edit the connection's permissions

TIP

The Protected and Private access levels are an optional feature. Depending on your contract, they might not be available.

Resource role

Role	Summary
Connection Owner	Can edit and delete the connection, and change its permission settings
Connection User	Can run SQL, view the results and tables, and publish related reports
Connection Viewer	Can view the results and tables

Up to 3 Connection Owners can be added (Fixed limits and constraints).

Operations and required roles

"X or higher" in the tables means that role and any higher role can perform the operation. Changing a connection's permission settings includes changing the access level and granting or changing resource roles.

Access level: Workspace

No individual permission grant is needed for members. Whether an operation is allowed is mainly determined by the workspace role.

Operation	Required role
Creating a connection	Workspace Editor or higher
Listing connection names	Workspace Viewer or higher
Editing and deleting a connection	Workspace Owner, or Connection Owner
Changing a connection's permission settings	Workspace Owner, or Connection Owner
Running SQL on a connection / downloading execution results	Workspace Editor or higher
Getting a connection's SQL execution results and table information	Workspace Viewer or higher

Access level: Protected

Only users and groups granted a resource role can use this connection. The Workspace Owner can change the connection's permission settings.

Operation	Required role
Creating a connection	Workspace Editor or higher
Listing connection names	Workspace Viewer or higher
Editing and deleting a connection	Workspace Owner, or (Workspace Viewer or higher and Connection Owner)
Changing a connection's permission settings	Workspace Owner, or (Workspace Viewer or higher and Connection Owner)
Running SQL on a connection / downloading execution results	Workspace Editor or higher, and Connection User or higher
Getting a connection's SQL execution results and table information	Workspace Viewer or higher, and Connection Viewer or higher

Access level: Private

Only users and groups granted a resource role can use this connection. Even the Workspace Owner can't change the connection's permission settings.

Operation	Required role
Creating a connection	Workspace Editor or higher
Listing connection names	Workspace Viewer or higher, and Connection Viewer or higher
Editing and deleting a connection	Workspace Viewer or higher, and Connection Owner
Changing a connection's permission settings	Workspace Viewer or higher, and Connection Owner
Running SQL on a connection / downloading execution results	Workspace Editor or higher, and Connection User or higher
Getting a connection's SQL execution results and table information	Workspace Viewer or higher, and Connection Viewer or higher

Operations on saved queries and the catalog also follow the permissions of the connection they're linked to. For details, see Query and Catalog.