Default Roles and Their Permissions in DataWorks Workspaces - DataWorks

DataWorks provides multiple default roles, including Project Owner, Workspace Administrator, Data Analyst, Developer, Operations and Maintenance (O&M) Engineer, Deployer, Visitor, Security Administrator, Model Designer, and Data Governance Administrator. This topic describes the permissions for each role.

By default, all DataWorks workspace-level default roles have read-only access to all workspace-level modules. However, their management and operational permissions for these modules differ, as shown in the following table.

Role	Description
Project Owner	The Workspace Owner has all permissions on a workspace and is typically the Alibaba Cloud account. For example, a Workspace Owner can assign roles to RAM users and remove any member who is not a Workspace Owner.
Workspace Administrator	This role has permissions that are second only to the permissions of the Project Owner role. The Workspace Administrator role can also be used to perform operations such as adding a user to a workspace as a member, removing a member from a workspace, or assigning a role to a member.
Data Analyst	This role has permissions only on DataAnalysis.
Development	This role has permissions to perform data development and maintenance operations on the DataStudio page of a workspace. Note If you want to perform data development operations as a RAM user, you must assign the Develop or Workspace Administrator role to the RAM user. If you want to perform the deploy operation as a RAM user, you must assign the O&M or Workspace Administrator role to the RAM user.
O&M	This role has permissions to deploy tasks to the production environment on the Create Deploy Task page and perform O&M operations on all tasks in a workspace in Operation Center.
Deployment	In multi-workspace mode, this role reviews task code and decides whether to commit it for O&M.
Visitor	This role has read-only permissions on workflows and code on the DataStudio page of a workspace.
Security Administrator	This role has permissions only on Data Security Guard.
Model Designer	This role has permissions to view models in Data Modeling and modify parameter configurations in Data Warehouse Planning, Data Standard, Dimensional Modeling, and Data Metric. This role does not have permissions to publish models.
Data Governance Administrator	This role has permissions to view and manage data governance content of the workspace to which this role belongs in Data Governance Center. Note This role does not have permissions to view data governance situations of all workspaces in a region from the global perspective or manage global governance operations, such as enabling check items at the global level. If you want to allow a RAM user to perform global governance operations, assign the Data Governance Administrator role at the tenant level to the RAM user. For more information, see Data Governance Administrator role at the tenant level. For more information about the features that are supported by the Data Governance Administrator role at the workspace level, see Data Governance.

For more information about the permissions for each DataWorks workspace-level feature, see the following sections:

Data Management
Publishing Management
Button Controls
Code Development
Function Development
Node Type Control
Resource Management
Workflow Development
Project Management
Workflow O&M
Node O&M
Dashboard
Baselines
Alert Monitoring
Data Integration
Intelligent Data Modeling
Data Analysis
Data Governance

In addition, workspace-level default roles have specific permissions for controlling access to MaxCompute engine data. For more information, see MaxCompute Data Permission Control Details.

Note

You can also use commands to query data permissions in MaxCompute. For more information, see Query Permission Information Using MaxCompute SQL. For example, you can run the desc role role_project_dev command to check whether the DataWorks Development role has the Create Table permission for a MaxCompute data source.
For more information about the mapping between DataWorks workspace-level default roles and MaxCompute engine permissions, see Appendix: Mapping Between Workspace-Level Preset Roles and MaxCompute Engine Permissions.

Data Management

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	O&M Engineer	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
Delete tables created by yourself
Set categories for tables created by yourself
View tables you favorited
Create new tables
Unhide tables created by yourself
Modify schema for tables created by yourself
View tables created by yourself
View your requested permissions
Hide tables created by yourself
Set lifecycle for tables created by yourself
Request data permissions for tables not created by yourself
Update tables in the development environment
Delete tables in the development environment
Data preview
Add assignment parameters

Publishing Management

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	Operations and Maintenance	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
Create deployment packages
View deployment package list
Revoke deployment packages
Execute or reject publishing
View deployment package contents
Cancel publishing

Button Controls

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Developer	Operations and Maintenance	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
Stop button
Format button
Edit button
Run button
Zoom in button
Save button
Expand/collapse button
Delete button

Code Development

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	O&M Engineer	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
Save and commit code
View code content
Create code
Delete code
View code list
Run code
Modify code
Download files
Upload files

Function Development

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	O&M	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
View function details
Create functions
Query functions
Delete functions

Node Type Control

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	Operations and Maintenance	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
PAI node
MR node
CDP node
SQL node
XLIB node
Shell node
Node Type: Virtual Node
script_seahawks node
dtboost_analytic node
dtboost_recommand node
pyodps node
ADBPG node
ADBMYSQL node
Node: entry node
Database node permissions

Resource Management

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	Operations and Maintenance (O&M)	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
View resource list
Delete resources
Create resources
Upload JAR files
Upload text files
Upload archive files

Workflow Development

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	O&M	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
Run or stop workflows
Save workflows
View workflow content
Commit node code
Modify workflows
View workflow list
Modify owner property
Open node code
Delete workflows
Create workflows
Create folders
Delete folders
Modify folders

Project Management

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	O&M Engineer	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
View basic project properties
Create new baselines
Delete baselines
Edit baselines
Search baseline list
View baselines
Test connectivity
Create new data sources
Delete data sources
Edit data sources
Search data sources
View project data source configuration
Enable scheduling
View task scheduling configuration
Create new project members
Edit project member roles
View project member list
Remove project members
Search project members
Modify compute engine configuration
View compute engine configuration
Query member list within the tenant
Modify basic project properties
Modify whether to enable scheduling
Allow code editing
Allow downloading SELECT results
Get project role list
Add project resource groups
Remove project resource groups
Set default project resource group
Get project resource group list
Create project resource groups
Delete resource groups
Execute resource group initialization
Get resource group node list
Add nodes to resource group
Delete resource group nodes
Update resource group node status and slots
Get list of projects attached to resource group
Batch attach resource groups to projects
Get ODPS role list
Create ODPS roles
Delete ODPS roles
Get ODPS role members
Modify ODPS role members
Get role permissions (including projects and tables)
Revoke project/table permissions
Add project/table permissions
Get ODPS security control policies
Modify use of ACL authorization
Modify permission for object creators to access objects
Modify permission for object creators to grant permissions on objects
Modify project data protection
Modify RAM user service
Update project publishing target
Refresh RAM users
Get ODPS user list
Share data sources
Migrate database tables
Import/export IDE design
Sync task resource group configuration
Enable PAI GPU for project
Access ODPS secure configuration in project management
Permission to create real-time data integration nodes
Delete workspaces

Workflow O&M

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Developer	O&M	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
Definition - View flowchart
Definition - Edit - Go to IDE
Instance - View flowchart
View flow definition - DAG upstream/downstream
View flow list
Definition - View workflow operation logs
Definition - Smoke testing
Definition - Data backfill
Definition - Modify owner
View flow details
View flow instance - DAG upstream/downstream
Instance - Pause
Instance - Resume
Instance Termination Task
Instance - Batch stop tasks
Instance - List
View execution logs
Instance - Rerun
Instance - Batch rerun
Instance - Query
Instance - Set to success
Rerun downstream instances
Check for first-time logon
Manual node DAG
Node freeze, pause
Node unfreeze, resume
Node lineage
Node details
Node operation log
Node modify baseline
Instance resume run
Instance remove dependency
Instance lineage
Instance details
Instance run history
Instance baseline impact
Take a node offline
Force rerun downstream
Instance force rerun
Instance priority modification

Node O&M

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Developer	O&M	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
Definition - Modify baseline
Definition - Batch modify baselines
Definition - View node code
Definition - Batch modify owners
Definition - Modify resource group
Definition - Batch modify resource groups
Definition - Smoke testing
Definition - Data backfill
Instance - Delete relationship
Instance - Pause
Instance - Resume
Refresh instance property information
Instance - Stop node instance
Instance - Batch stop tasks
Instance - Modify priority
Instance - Refresh relationship
Instance - Rerun node instance
Instance - Set node instance to success
Task instance diagnosis
Wait time diagnosis
Resource group basic information
Resource group run information (running/waiting)
Resource group slot usage trend
List of tasks using the resource group
Show diagnostic information
odps_instance list
Instance supports dqc rerun
HTTP trigger node - Trigger instance

Dashboard

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Developer	O&M	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
View number of baseline breaches
Exclude a record from the dashboard
View error ranking for the last month
View task scheduling count trend
View task completion status
View task run status
View task execution duration ranking
View task type distribution
Dashboard highlights

Baselines

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	O&M Engineer	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
View Mosad baseline metrics
View Mosad baseline list

Alert Monitoring

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Developer	Operations and Maintenance	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
View notification list
Turn off alerts
Batch turn off alerts
Phone switch
Add custom reminders
Delete custom reminders
Edit custom reminders
View custom reminders
View all event list
View event details
View personal event list

Data Integration

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	Operations and Maintenance	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
Data Integration - Edit node
Data Integration - View node
Data Integration - Delete node
Project sync resource management menu
Project sync resource group list
Project sync resource group creation
Project sync resource group manage machine list
Project sync resource group add machines
Project sync resource group delete machines
Modify machines in a project-synced resource group
Project sync resource group get resource group ak
Project sync resource group deletion
Project resource consumption monitoring
Operation Center task modify resource group
Sync task list menu
Convert task to script
Get project member list
New code interface
Save/update code interface
Get code interface by fileId
Get data integration node list
Search table interface
Search field interface
Query data source list interface
New data source interface
Query data source details interface
Update data source interface
Delete data source interface
Test connectivity
Data preview
Check if OTS Stream is enabled
Enable OTS
Query ODPS table creation statement
Create new ODPS table
Query ODPS table creation status
Data integration data source sharing permission point

Intelligent Data Modeling

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Development	Operations and Maintenance (O&M)	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
Data Metric - Edit
Data Metric - View
Data Metric - Publish
Dimensional Modeling - View
Dimensional Modeling - Edit
Dimensional Modeling - Publish
Data Standard - View
Data Standard - Edit
Data Standard - Publish
Data Warehouse Planning - View
Data Warehouse Planning - Edit
Dimensional Modeling - Publish to development environment

Data Analysis

Permission Point	Project Owner	Workspace Administrator	Data Analyst	Developer	Operations and Maintenance	Deployment	Visitor	Security Administrator	Model Designer	Data Governance Administrator
View Data Analysis product page
Use Data Analysis product

Note

By default, Custom Role do not have the permissions of the Data Analyst role. If a custom role needs to use the Data Analysis product, contact a Workspace Administrator to grant the Data Analyst role. For more information about granting permissions, see Workspace-level module permission control. For more information about custom roles, see Permission Details: Workspace-Level Roles.

Data Governance

Permission Point	Project Owner	Workspace Administrator	Data Governance Administrator	Data Analyst	Developer	Operations and Maintenance (O&M)	Deployment	Visitor	Security Administrator	Model Designer
Governance Assessment - Tenant View
Governance Assessment - Workspace View
Governance Assessment - Personal View - View all members in the project
Governance Assessment - Leaderboard - Workspace - View current project
Governance Assessment - Leaderboard - Personal Ranking - View all members in the project
Governance Workbench - Governance Item Issues - Workspace View
Governance Workbench - Governance Item Issues - Personal View
Workspace View - Table - Modify table owner
Personal View - Table - Modify table owner
Workspace View - Table - Modify table lifecycle
Personal View - Table - Modify table lifecycle
Workspace View - Table - Create unpublish plan
Workspace View - Table - Execute unpublish plan
Personal View - Table - Create unpublish plan
Personal View - Table - Execute unpublish plan
Workspace View - Task - Modify task owner
Personal View - Task - Modify task owner
Workspace View - Task - Create unpublish plan
Personal View - Task - Create unpublish plan
Workspace Task - Task - Modify missing dependencies
Workspace View - Governance Item Issues - Add to whitelist
Governance Workbench - Check Item Events - All metric data in the workspace
Governance Workbench - Whitelist - Whitelists in the workspace
Governance Workbench - Whitelist - Close whitelists in the workspace
Governance Workbench - Graceful Shutdown - Create unpublish plan
Governance Workbench - Graceful Shutdown - View unpublish plan - Query current project list
Governance Workbench - Graceful Shutdown - View unpublish plan details
Governance Workbench - Graceful Shutdown - Unpublish plan operations
Workspace - Materialized View - Recommended by workspace
Workspace - Materialized View - Create materialized view
Workspace - Materialized View - View materialized view recommendation list
Workspace - Materialized View - View materialized view list
Governance Workbench - Task/Table 360 - View 360 information in the workspace
Governance Workbench - Task/Table 360 - View 360 information in the workspace
Governance Workbench - Data Exporting - View - Personal dimension definition
Governance Workbench - Data Exporting - Create
Governance Workbench - Data Exporting - Create - Personal View
Usage Analysis - All workspaces
Usage Analysis - Single workspace
Knowledge Base
Configuration Management - Solution Templates
Configuration Management - Check Items - View configuration
Configuration Management - Check Items - Global switch operation
Configuration Management - Check Items - Operations
Configuration Management - Governance Items - View
Configuration Management - Governance Items - Exclusion rules
Configuration Management - Notification Settings - View in workspace
Configuration Management - Notification Settings - Add by selecting tenant
Configuration Management - Notification Settings - Add by selecting current workspace
Configuration Management - Notification Settings - Select individual