# Global and Dataset Roles

Soda Cloud uses **Global Roles** and **Dataset Roles** to manage access and permissions. These roles ensure users and user groups have the right level of access based on their responsibilities.

## Global Roles

{% hint style="warning" %}
Only users with the **Manage organization settings** permission on the organization can define and assign global roles. [Global and Dataset Roles](https://docs.soda.io/soda-v4/organization-and-admin-settings/global-and-dataset-roles)
{% endhint %}

Global roles define permissions across the entire organization in Soda Cloud.

By default, Soda Cloud provides to Global Roles: Admin and Users. You can create custom roles with a subset of the permissions

<table><thead><tr><th>Permission Group</th><th>Descriptions</th><th width="100">Admin</th><th width="100">User</th></tr></thead><tbody><tr><td>Manage data sources and agents</td><td><ul><li>Allow to deploy a new Soda Agent as well as configure data source connections in Soda Cloud.</li></ul><p></p></td><td>✓</td><td></td></tr><tr><td>Create new datasets and data sources with Soda Core library </td><td><ul><li>Allow the creation of new data sources in Soda Cloud when using the Soda Core library.</li><li>Allow to onboard datasets in  Soda Cloud on data sources connected with Soda Agent. See <a data-mention href="../onboard-data-sources-and-datasets/onboard-datasets-on-soda-cloud">onboard-datasets-on-soda-cloud</a></li></ul></td><td>✓</td><td>✓</td></tr><tr><td>Manage attributes</td><td><ul><li>Allow to define which datasets and check attributes are available to use in the organization.</li></ul></td><td>✓</td><td></td></tr><tr><td>Manage notification rules</td><td><ul><li>Allow to manage how notifications are sent.</li></ul></td><td>✓</td><td>✓</td></tr><tr><td>Manage organization settings</td><td><ul><li>Manage organization settings</li><li> Deactivate users</li><li> Create, edit, or delete user groups</li><li> Create, edit, or delete dataset roles</li><li> Create, edit, or delete global roles</li><li>Assign global roles to users or user groups</li><li> Add, edit, or delete integrations</li><li> Access and download the audit trail</li></ul></td><td>✓</td><td></td></tr><tr><td>Manage scan definitions</td><td><ul><li>Update scan definition</li><li>Run scan definition manually</li></ul></td><td>✓</td><td></td></tr></tbody></table>

### Create Custom Global Roles

You can create custom global roles to match your organization’s needs.

To create a global role:

{% stepper %}
{% step %}
Go to the **Global Roles** section in **Settings**.
{% endstep %}

{% step %}
Click Add Global Role to create a new role.

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2FEC3VHQ7eZtAaktpUia0n%2Fimage.png?alt=media&#x26;token=39cc451e-93cb-4da3-afc6-bbd3886de8c7" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Enter a **name** for the role.
{% endstep %}

{% step %}
Select the **permissions** the role should have.

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2FNPmMShuTwwW04wCAFlTM%2Fglobal-role-create-1%20(1).png?alt=media&#x26;token=d3db155e-d01a-4247-b533-73698c324461" alt="" width="519"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click **Save**.
{% endstep %}
{% endstepper %}

### Edit Custom Global Roles

You can edit global roles at any time to adjust permissions as your organization’s needs evolve.

To edit a global role:

{% stepper %}
{% step %}
Go to the **Global Roles** section in **Settings**.
{% endstep %}

{% step %}
Find the global role you want to modify.
{% endstep %}

{% step %}
Click the context menu next to the role and select Edit Global Role.

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2FDpF9WMIcE0sbktixQRRB%2Fimage.png?alt=media&#x26;token=1f6843c2-0452-40ee-bf27-c7aabc541da2" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Adjust the role’s **name** and **permissions** as needed.
{% endstep %}

{% step %}
Click **Save** to apply your changes.
{% endstep %}
{% endstepper %}

### Assign Members to Global Roles

You can assign roles to individual users or user groups to grant them the associated permissions.

To assign a global role:

{% stepper %}
{% step %}
Go to the **Global Roles** section in **Settings**.
{% endstep %}

{% step %}
Find the global role you want to assign.
{% endstep %}

{% step %}
Click the context menu next to the role and select **Assign Members**.

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2Ft32LO4SZ9o4w68WcCvmg%2Fimage.png?alt=media&#x26;token=ec3169c5-8845-4b17-bd75-8c07233ca32c" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Select the users or user groups that should have the global roles.
{% endstep %}

{% step %}
Click **Save** to apply your changes.
{% endstep %}
{% endstepper %}

You can also assign roles on the Users and User groups tabs:

* For users: [user-management](https://docs.soda.io/organization-and-admin-settings/user-management "mention")
* For user groups: [user-management](https://docs.soda.io/organization-and-admin-settings/user-management "mention")

## Dataset roles

Dataset roles define permissions for specific datasets.

{% hint style="warning" %}
Only users with the **Manage organization settings** permission on the organization can define and update dataset roles, as well as default responsibilities. [Global and Dataset Roles](https://docs.soda.io/soda-v4/organization-and-admin-settings/global-and-dataset-roles)
{% endhint %}

By default, Soda Cloud provides to Dataset Roles: Manager, Editor, and User. You can create custom roles with a subset of the permissions

<table><thead><tr><th>Permission Group</th><th>Description</th><th width="100">Manager</th><th width="100">Editor</th><th width="100">Viewer</th></tr></thead><tbody><tr><td>View dataset</td><td>Access the dataset and view checks</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Access dataset profiling and samples</td><td>Allow users to see insights about the data</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Access failed row samples for checks</td><td>Allow users to see samples of rows that are considered invalid</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Configure dataset</td><td>Allow users to define dataset attributes and owner, change settings, and add/enable/configure metric monitors at a dataset level </td><td>✓</td><td>✓</td><td></td></tr><tr><td>Manage dataset responsibilities</td><td>Allow users to grant and remove permissions through responsibilities.</td><td>✓</td><td></td><td></td></tr><tr><td>Manage Contracts</td><td>Allow users to modify as well as verifying the Data contract</td><td>✓</td><td>✓</td><td></td></tr><tr><td>Propose checks</td><td>Allow users to propose changes in the Data Contract</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Manage incidents</td><td>Allow users to edit and close incidents.</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Delete dataset</td><td>Allow users to remove a dataset and its checks.</td><td>✓</td><td></td><td></td></tr></tbody></table>

### Create Custom Dataset Roles

You can create custom dataset roles to match your organization’s needs.

To create a dataset role:

{% stepper %}
{% step %}
Go to the **Dataset Roles** section in **Settings**.
{% endstep %}

{% step %}
Click **Add Dataset Role** to create a new role.

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2FRQ5sZo9Cpady6JZ5UUaY%2Fimage.png?alt=media&#x26;token=434d8319-9e3e-4b09-ad00-a6d2462b8a84" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Enter a **name** for the role.
{% endstep %}

{% step %}
Select the **permissions** the role should have.

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2F0AYj4tAWQEuceOoUupg4%2Fimage.png?alt=media&#x26;token=10f85e19-b4ff-4d07-a28b-e07150ac9ef5" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click **Save** to apply your changes.
{% endstep %}
{% endstepper %}

### Edit Dataset Roles

You can edit dataset roles at any time to adjust permissions as your organization’s needs evolve.

To edit a dataset role:

{% stepper %}
{% step %}
Go to the **Dataset Roles** section in **Settings**.
{% endstep %}

{% step %}
Find the dataset role you want to modify.
{% endstep %}

{% step %}
Click the context menu next to the role and select **Edit Dataset Role**.

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2FDWbQLbCCRWPL1wUhr1tO%2Fimage.png?alt=media&#x26;token=2f8ee2ad-2a48-4f80-884f-5bcc2850b304" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Adjust the role’s **name** and **permissions** as needed.
{% endstep %}

{% step %}
Click **Save** to apply your changes.
{% endstep %}
{% endstepper %}

### Assign dataset responsibilities

**Responsibilities** in Soda Cloud define who has access to a dataset and what they are allowed to do. They are assigned by mapping **users** or **user groups** to a **dataset role.**

This ensures that the right people have the appropriate permissions for each dataset, such as the ability to manage checks, propose new rules, or view profiling information.

For example:

* Assign a **Manager** role to a dataset owner who needs full control.
* Assign a **Viewer** role to a business user who only needs to monitor data quality results.

By assigning responsibilities, you ensure clear access control, accountability, and governance across your datasets.

Learn about how to set up responsibilities on a dataset: [dataset-attributes-and-responsibilities](https://docs.soda.io/dataset-attributes-and-responsibilities "mention")

### Define default responsibilities

#### For the dataset owner

Soda Cloud allows you to define **default responsibilities** for the dataset owner, which will automatically be granted for all dataset owners. This ensures that all users have a consistent baseline level of access unless you choose to customize it.

By default, all dataset owners have the "Manager" role.

**How to Configure Default Responsibilities**

{% stepper %}
{% step %}
Go to the **Organization Settings** page in Soda Cloud.
{% endstep %}

{% step %}
Locate the **Datasets Roles** section.
{% endstep %}

{% step %}
Select the **dataset role** to assign to the Dataset Owners

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2FPsef38rL1fIxnm5kbdpp%2Fdataset-role-owner.png?alt=media&#x26;token=ddea07f8-1566-4595-9bd0-c4fa5491dea7" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click **Save** on the top right of the page to apply changes

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2Flhaw3WUs0BhlHUBMfhA1%2Fsave-default.png?alt=media&#x26;token=b166408d-47c0-4731-91b5-95b28c850647" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

#### **For everyone**

Soda Cloud allows you to define **default responsibilities** for the **Everyone** group, which will automatically apply to all newly onboarded datasets. This ensures that all users have a consistent baseline level of access unless you choose to customize it.

By default:

* The **Everyone** group is assigned as a "Viewer" for all new datasets.
* This setting applies to **all users** in your organization unless disabled.

You can either customize the default role or **disable** the default responsibilities if you do not want the Everyone group to receive any automatic access to new datasets.

**How to Configure Default Responsibilities**

{% stepper %}
{% step %}
Go to the **Organization Settings** page in Soda Cloud.
{% endstep %}

{% step %}
Locate the **Datasets Roles** section.
{% endstep %}

{% step %}
Select the **dataset role** to assign to the Everyone group for new datasets.
{% endstep %}

{% step %}
To disable default responsibilities, toggle the feature **off**.

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2F37H9sY4cjRAUlnRUMUIc%2Fdataset-role-everyone.png?alt=media&#x26;token=cd241d00-454d-4bc1-b765-7b6873a73552" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click **Save** on the top right of the page to apply changes

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2F67MGmUR36zaKYXaAf5ma%2Fsave-default%20(1).png?alt=media&#x26;token=aa3d7f44-f93b-4cce-805b-de3d08af2b72" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

***

## Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) in Soda Cloud ensures that users can only access and interact with data according to their assigned roles; roles and permissions are fully customizable to adapt to your organization's needs.

RBAC is designed to:

* Enforce least-privilege access
* Prevent direct user-to-permission grants
* Scope access by organization and role
* Ensure that all access is authenticated and authorized

Here’s how these features can benefit your organization on the journey to governed data democratization:

#### Customizable roles and permissions

With Soda, **you can tailor access to data** to align with your specific needs. For instance, you can create a role for Product Marketing that allows the team to view sample data and propose data quality checks on particular datasets, while restricting editing capabilities on others.

If a **default role** is not quite what you're looking for, **you can easily edit its permissions** to add new capabilities.

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2FukWyDm6vwtIGYuIRav2S%2Froles.gif?alt=media&#x26;token=55d59923-d67e-4154-acfd-c822155ffcdc" alt="" width="375"><figcaption></figcaption></figure>

#### Streamlined user management

You can **enable user group synchronization from your Identity Provider (IdP) to Soda Cloud**, reducing the administrative burden of ensuring consistent permissions. This saves time during onboarding and offboarding while minimizing human error.

#### Bulk editing for enhanced efficiency

You can assign roles and permissions to multiple datasets in one go through Soda Cloud UI or via [API](https://docs.soda.io/organization-and-admin-settings/broken-reference).

<figure><img src="https://1123167021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FA2PmHkO5cBgeRPdiPPOG%2Fuploads%2FKbwC3DYqaSEKzYy9f06c%2Fbulk-edit.gif?alt=media&#x26;token=68a49c27-4a09-421d-ae10-43174e34d65a" alt="" width="563"><figcaption></figcaption></figure>

### Architecture

#### Strong identity as the security perimeter

Access to critical systems is federated via an Identity Provider (IdP) with:

* Multi-factor authentication (MFA) enforcement
* Role-based access control (RBAC)
* Unique user identification
* Least-privilege, role-scoped permissions

Roles are:

* Managed centrally in the IdP
* Mapped to system permissions

User group synchronization from the IdP to Soda Cloud is supported to streamline onboarding and offboarding while minimizing human error.

#### Authentication and enforcement

Every request to Soda Cloud:

1. Is authenticated
2. Is scoped to the user’s organization
3. Passes through RBAC enforcement

{% hint style="info" %}
Soda Cloud does **not** provide a capability to publish content or files that can be accessed by users who are not authenticated members of the organization. Public link sharing and anonymous access capabilities are not allowed to **prevent exposure of Soda Cloud content outside the authenticated organization**.
{% endhint %}

### **How access control helps data democratization**

Access control empowers data owners to efficiently manage data requests while ensuring that data is accessible.

* **Accelerates value creation** by enabling quick access to a wide range of dataset
* **Improves decision making** by ensuring users can easily identify and use the most relevant data

<br>

***

{% if visitor.claims.plan === 'free' %}
{% hint style="success" %}
You are **logged in to Soda** and seeing the **Free license** documentation. Learn more about [documentation-access-and-licensing](https://docs.soda.io/reference/documentation-access-and-licensing "mention").
{% endhint %}
{% endif %}

{% if visitor.claims.plan === 'teams' %}
{% hint style="success" %}
You are **logged in to Soda** and seeing the **Team license** documentation. Learn more about [documentation-access-and-licensing](https://docs.soda.io/reference/documentation-access-and-licensing "mention").
{% endhint %}
{% endif %}

{% if visitor.claims.plan === 'enterprise' || visitor.claims.plan === 'enterpriseUserBased' %}
{% hint style="success" %}
You are **logged in to Soda** and seeing the **Enterprise license** documentation. Learn more about [documentation-access-and-licensing](https://docs.soda.io/reference/documentation-access-and-licensing "mention").
{% endhint %}
{% endif %}

{% if !(visitor.claims.plan === 'free' || visitor.claims.plan === 'teams' || visitor.claims.plan === 'enterprise' || visitor.claims.plan === 'enterpriseUserBased') %}
{% hint style="info" %}
You are **not logged in to Soda** and are viewing the default public documentation. Learn more about [documentation-access-and-licensing](https://docs.soda.io/reference/documentation-access-and-licensing "mention").
{% endhint %}
{% endif %}