Permission scope and types
What permissions can I request in Security Center?
Security Center lets you request permissions on tables in DataWorks workspaces — in both the development environment and the production environment.
If LabelSecurity is enabled for a workspace, you can also request permissions on individual fields within that workspace. If LabelSecurity is disabled, table-level permissions are the only option.
How do I set LabelSecurity for fields?
Go to Data Map to set the LabelSecurity parameter for fields.
How requests are processed
Who reviews and approves my request?
A workspace administrator or the table owner handles your request. Once either approves or rejects it, the request is closed — no further action is needed from the other party.
Why do I see two requests after submitting one?
The tables in your request belong to two different owners. Security Center automatically splits the request by table owner, so each owner receives only the part relevant to them.
Why did a request disappear from my Pending My Approval tab before I acted on it?
Another workspace administrator or table owner approved the request first. Once approved, the request is closed and no longer appears in your queue.
Permission validity and unexpected permissions
I requested field permissions for one month. Why did they become permanent after approval?
The field's security level is zero, or it is not higher than your account's security level.
Why do I have permissions on tables or fields I never requested?
Security Center grants permissions automatically in certain situations. Two rules drive this behavior:
Security level threshold: When your request is approved, Security Center automatically extends permissions to any additional fields whose security level is zero or not higher than your account's security level — even if you did not request those fields explicitly.
Admin grant: A workspace administrator granted the permissions directly by running commands in the DataWorks console, bypassing the request workflow.
Revoking permissions
Why can't I revoke permissions on a field?
Revocation is restricted by security level. You can only revoke permissions on fields whose security level is higher than your own account's security level.
Can I revoke permissions without using the original permission request?
Yes. The Authorizations page in Security Center shows an access control list (ACL) of all users, regardless of how the permissions were originally granted. Revoke any granted permissions directly from there — no need to trace back to the original request.
Alibaba Cloud account limitations
Why can't I request permissions using my Alibaba Cloud account?
An Alibaba Cloud account has all permissions by default, so there is nothing to request. Entry points for permission requests are hidden for Alibaba Cloud accounts. This does not affect how the account works.
Errors and troubleshooting
What do I do when I see "An error occurred in the MaxCompute project" while specifying the workspace and environment?
Send the error message and error code to your workspace administrator for troubleshooting.
Security Center and Data Management
What is the relationship between Security Center and Data Management?
Security Center is a service that upgrades and replaces the permission and security features in Data Management. To view permissions that were requested or granted via the odpscmd grant command in Data Management, go to My Permissions in the left-side navigation pane of Security Center.
For new permission requests and approvals, use Security Center. Data Management no longer supports permission requesting or approval.
Can I view Data Management's permission requesting and approval records in Security Center?
No. Security Center and Data Management have not synchronized their records. Go to Data Management directly to view its permission requesting and approval records.
A permission request I submitted in Data Management is still pending. Do I need to resubmit it in Security Center?
Yes. Because the two systems have not synchronized records, submit the request again in Security Center.