DataWorks provides roles such as project owner, workspace administrator, data analyst, developer, O&M engineer, deployment engineer, visitor, security administrator, model designer, and data governance administrator. This topic describes their permissions.
Built-in workspace roles can read all workspace-level modules by default, but their management and operation permissions differ, as shown in the following tables.
|
Role |
Description |
|
Project Owner |
The Workspace Owner has all permissions in the workspace and is typically an Alibaba Cloud account. For example, they can assign roles to RAM users as needed and remove members who are not the owner from the workspace. |
|
Workspace Administrator |
This role has permissions that are second only to the permissions of the Workspace Administrator role. The Workspace Administrator role can also be used to perform operations such as adding a user to a workspace as a member, removing a member from a workspace, or assigning a role to a member. |
|
Data Analyst |
This role has permissions only on DataAnalysis. |
|
Development |
This role has permissions to perform data development and maintenance operations on the DataStudio page of a workspace. Note
|
|
O&M |
This role has permissions to deploy tasks to the production environment on the Create Deploy Task page and perform O&M operations on all tasks in a workspace in Operation Center. |
|
Deployment |
In a multi-workspace setup, this role reviews task code and decides whether to submit it for O&M. |
|
Visitor |
This role has read-only permissions on workflows and code on the DataStudio page of a workspace. |
|
Security Administrator |
This role has permissions only on Data Security Guard. |
|
Model Designer |
This role has permissions to view models in Data Modeling and modify parameter configurations in Data Warehouse Planning, Data Standard, Dimensional Modeling, and Data Metric. This role does not have permissions to publish models. |
|
Data Governance Administrator |
This role has permissions to view and manage data governance content of the workspace to which this role belongs in Data Governance Center. Note
|
For details about each role's permissions for workspace features, see:
Built-in workspace roles also control some permissions on MaxCompute engine data. For details, seeMaxCompute data permission control.
You can also use commands to view data permissions in MaxCompute. For details, seeQuery permissions by using MaxCompute SQL. For example, rundesc role role_project_dev; to check whether the DataWorksDevelopmentrole can create tables (Create Table) in the MaxCompute data source.
For the mapping between DataWorks built-in workspace roles and MaxCompute engine permissions, seeRole mappings: DataWorks vs MaxCompute.