> For the complete documentation index, see [llms.txt](https://docs.soda.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.soda.io/organization-and-admin-settings/service-accounts/bind-a-runner-to-a-service-account.md). # Bind a runner to a service account {% hint style="info" %} **Preview feature.** Runner–service account binding and runnerless data source creation are **in private preview**. Contact us at to enable it in your organization. {% endhint %} By default, a Soda Runner has organization-wide access: it can reach every data source in your organization. Binding a runner to a service account **restricts the runner to only the global roles and resource permissions granted to that single account**, so it can access only the data sources and datasets that account is explicitly permitted to use. **Use this when different teams share** one Soda Cloud organization but **must not access** each other's data sources. The runner's reach is scoped only to what one service account can access, instead of the whole organization. | Default runner | Runner bound to a service account | | -------------------------------------------- | -------------------------------------------------------------------- | | Organization-wide access to all data sources | Access limited to what the bound service account is permitted to use | | Acts with broad implicit reach | Assumes only the global roles assigned to that service account | | No pre-setup required | Service account must exist before the runner is created | ### Prerequisites * Opt in and enable this feature with our [support team](mailto:support@soda.io). * You have the **Manage organization settings** permission. * The service account you want to bind already exists. It must be created **before** you set up the runner. ## Create a runner bound to a service account When you create a runner, you now choose its access model: {% stepper %} {% step %} **Create the service account** if you haven't yet If you haven't already, [create a service account](/organization-and-admin-settings/service-accounts.md#create-a-service-account) for the team or workload this runner will serve. {% endstep %} {% step %} **Onboard a data source** and select **no runner** as default runner Begin creating a new data source. When prompted to select a default runner, **select runner later** on the dropdown menu:
{% endstep %} {% step %} **Create a new runner** Navigate to the **Runners** page, then **create a new runner** and select **bind to a service account:**
{% endstep %} {% step %} **Select the service account to bind** Choose the service account to bind. The runner will inherit that account's global roles and resource permissions, and nothing more.
{% endstep %} {% step %} **Finish runner setup** Complete the [runner deployment](/deployment-options.md) as usual. Once the runner connects, the bound service account will allow to finish setup. {% endstep %} {% endstepper %} {% hint style="warning" %} **Data sources without runners have significant limitations.** * Test connection disabled * Dataset onboarding blocked * Diagnostic warehouse functionality unavailable Make sure that your data sources have a runner connected. {% endhint %} ### Permission requirements Because a bound runner only assumes its service account's permissions, the account must be granted access explicitly, at three levels: | Level | Minimum role | Why | | ------------------ | --------------------------------------- | -------------------------------------------------------------------------------------------- | | Global role | Permissions such as **create datasets** | Lets the account perform org-level actions the runner needs | | Data source access | **Viewer** | Minimum required to access the data source | | Dataset access | **Editor** | Required to generate contracts. A **Viewer** role is not sufficient for contract generation. | {% hint style="info" %} The **Viewer** role is enough to read a data source but **not** to generate contracts — that requires **Editor** at the dataset level. If contract generation fails for a bound runner, check the service account's dataset role first. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.soda.io/organization-and-admin-settings/service-accounts/bind-a-runner-to-a-service-account.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.