> For the complete documentation index, see [llms.txt](https://docs.soda.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.soda.io/organization-and-admin-settings/global-and-dataset-roles.md).

# Global and Dataset Roles

Soda Cloud uses **Global Roles** and **Dataset Roles** to manage access and permissions. These roles ensure users and user groups have the right level of access based on their responsibilities.

## Global Roles

{% hint style="warning" %}
Only users with the **Manage organization settings** permission on the organization can define and assign global roles. [Global and Dataset Roles](https://docs.soda.io/soda-v4/organization-and-admin-settings/global-and-dataset-roles)
{% endhint %}

Global roles define permissions across the entire organization in Soda Cloud.

By default, Soda Cloud provides to Global Roles: Admin and Users. You can create custom roles with a subset of the permissions

<table><thead><tr><th>Permission Group</th><th>Description</th><th width="100">Admin</th><th width="100">User</th></tr></thead><tbody><tr><td>Create data sources and manage runners<sup>1</sup></td><td><ul><li>Allow to deploy a new Soda Runner and manage runner configuration in Soda Cloud.</li><li>Allow the creation of new data source connections in Soda Cloud.</li><li>Does <strong>not</strong> grant access to existing data sources. Access to read or modify a data source is governed by Data Source Roles.</li></ul></td><td>✓</td><td></td></tr><tr><td>Create new datasets and data sources with Core/Library</td><td><ul><li>Allow the creation of new data sources in Soda Cloud when using the Core/Library.</li><li>Allow to onboard datasets in Soda Cloud on data sources connected with Soda Runner. See <a data-mention href="/pages/cHo9ixopiR0flOMCbyUF">/pages/cHo9ixopiR0flOMCbyUF</a></li><li>Onboarding a dataset is permitted when a user has <strong>either</strong> this global permission <strong>or</strong> the <strong>Create datasets</strong> permission on the target data source via a Data Source Role.</li></ul></td><td>✓</td><td>✓</td></tr><tr><td>Manage attributes</td><td><ul><li>Allow to define which datasets and check attributes are available to use in the organization.</li></ul></td><td>✓</td><td></td></tr><tr><td>Manage notification rules</td><td><ul><li>Allow to manage how notifications are sent.</li></ul></td><td>✓</td><td>✓</td></tr><tr><td>Manage organization settings</td><td><ul><li>Manage organization settings</li><li>Deactivate users</li><li>Create, edit, or delete user groups</li><li>Create, edit, or delete dataset roles</li><li>Create, edit, or delete global roles</li><li>Assign global roles to users or user groups</li><li>Add, edit, or delete integrations</li><li>Access and download the audit trail</li></ul></td><td>✓</td><td></td></tr><tr><td>Manage scan definitions</td><td><ul><li>Update scan definition</li><li>Run scan definition manually</li></ul></td><td>✓</td><td></td></tr></tbody></table>

<sup>1</sup> If your organization hasn't enabled [data source roles](#data-source-roles), the permission group "Create data sources and manage runners" is called **"Manage data sources and runners".**

* Description: Allow to deploy a new Soda Runner as well as configure data source connections in Soda Cloud.

### Create Custom Global Roles

You can create custom global roles to match your organization’s needs.

To create a global role:

{% stepper %}
{% step %}
Go to the **Global Roles** section in **Settings**.
{% endstep %}

{% step %}
Click Add Global Role to create a new role.

<figure><img src="/files/wp4PJgssEZNqhKJYWmIs" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Enter a **name** for the role.
{% endstep %}

{% step %}
Select the **permissions** the role should have.

<figure><img src="/files/4fTU5O8SOAHt8c23mhf1" alt="" width="519"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click **Save**.
{% endstep %}
{% endstepper %}

### Edit Custom Global Roles

You can edit global roles at any time to adjust permissions as your organization’s needs evolve.

To edit a global role:

{% stepper %}
{% step %}
Go to the **Global Roles** section in **Settings**.
{% endstep %}

{% step %}
Find the global role you want to modify.
{% endstep %}

{% step %}
Click the context menu next to the role and select Edit Global Role.

<figure><img src="/files/jxqg2kHGKkosyqzuEBuZ" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Adjust the role’s **name** and **permissions** as needed.
{% endstep %}

{% step %}
Click **Save** to apply your changes.
{% endstep %}
{% endstepper %}

### Assign Members to Global Roles

You can assign roles to individual users or user groups to grant them the associated permissions.

To assign a global role:

{% stepper %}
{% step %}
Go to the **Global Roles** section in **Settings**.
{% endstep %}

{% step %}
Find the global role you want to assign.
{% endstep %}

{% step %}
Click the context menu next to the role and select **Assign Members**.

<figure><img src="/files/3ApJpAetoEXV516ernTR" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Select the users or user groups that should have the global roles.
{% endstep %}

{% step %}
Click **Save** to apply your changes.
{% endstep %}
{% endstepper %}

You can also assign roles on the Users and User groups tabs:

* For users: [User management](/organization-and-admin-settings/user-management.md)
* For user groups: [User management](/organization-and-admin-settings/user-management.md)

## Data source roles

{% hint style="info" %}
Data Source Roles are available as a feature preview. **Existing organizations must opt in**, so that current workflows are not interrupted.

Contact <support@soda.io> to enable this feature on Soda Cloud.
{% endhint %}

Data source roles define permissions at the level of an individual data source. They control who can see, configure, and manage a data source, and who can manage other users' access to it.

By default, Soda Cloud provides three data source roles: **Manager**, **Editor**, and **Viewer**. You can create custom roles with a subset of the permissions.

<table><thead><tr><th>Permission</th><th>Description</th><th width="116.6666259765625">Manager</th><th width="100">Editor</th><th width="100">Viewer</th></tr></thead><tbody><tr><td><strong>View data source</strong></td><td>See the data source and the datasets, checks, and results onboarded from it. Always enabled for any user who holds a role on the data source.</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td><strong>Create datasets</strong></td><td>Onboard new datasets on this data source.</td><td>✓</td><td>✓</td><td></td></tr><tr><td><strong>Manage data source settings</strong></td><td>Edit the connection, diagnostics warehouse, and onboarding rules for the data source.</td><td>✓</td><td>✓</td><td></td></tr><tr><td><strong>Delete data source</strong></td><td>Remove the data source.</td><td>✓</td><td>✓</td><td></td></tr><tr><td><strong>Manage responsibilities</strong></td><td>Assign and remove other users' permissions on this data source.</td><td>✓</td><td></td><td></td></tr></tbody></table>

{% hint style="warning" %}
**Data source roles and dataset roles are evaluated separately; their permissions are not merged.**

**A user must have a data source role** on a data source **to see** any of its **datasets**, **checks**, **or results.** Without a role on the data source, the data source and everything onboarded from it are **not visible** to the user, even if that user holds a dataset role on one of its datasets.
{% endhint %}

### Migration to data source roles

When data source roles are enabled for an organization, existing access is migrated automatically:

* Users with the **Create data sources and manage runners** permission (previously "Manage data sources and agents") are granted the **Manager** role on all existing data sources.
* If an **Everyone** user group exists, it is granted the **Viewer** role on all existing data sources.

{% hint style="info" %}
In large organizations, this migration may take several minutes to complete, because a permission is created for each data source.
{% endhint %}

## Dataset roles

Dataset roles define permissions for specific datasets.

{% hint style="warning" %}
Only users with the **Manage organization settings** permission on the organization can define and update dataset roles, as well as default responsibilities. [Global and Dataset Roles](https://docs.soda.io/soda-v4/organization-and-admin-settings/global-and-dataset-roles)
{% endhint %}

By default, Soda Cloud provides to Dataset Roles: Manager, Editor, and User. You can create custom roles with a subset of the permissions

<table><thead><tr><th>Permission Group</th><th>Description</th><th width="100">Manager</th><th width="100">Editor</th><th width="100">Viewer</th></tr></thead><tbody><tr><td>View dataset</td><td>Access the dataset and view checks</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Access dataset profiling and samples</td><td>Allow users to see insights about the data</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Access failed row samples for checks</td><td>Allow users to see samples of rows that are considered invalid</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Configure dataset</td><td>Allow users to define dataset attributes and owner, change settings, and add/enable/configure metric monitors at a dataset level</td><td>✓</td><td>✓</td><td></td></tr><tr><td>Manage dataset responsibilities</td><td>Allow users to grant and remove permissions through responsibilities.</td><td>✓</td><td></td><td></td></tr><tr><td>Manage Contracts</td><td>Allow users to modify as well as verifying the Data contract</td><td>✓</td><td>✓</td><td></td></tr><tr><td>Propose checks</td><td>Allow users to propose changes in the Data Contract</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Manage incidents</td><td>Allow users to edit and close incidents.</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Delete dataset</td><td>Allow users to remove a dataset and its checks.</td><td>✓</td><td></td><td></td></tr></tbody></table>

### Create Custom Dataset Roles

You can create custom dataset roles to match your organization’s needs.

To create a dataset role:

{% stepper %}
{% step %}
Go to the **Dataset Roles** section in **Settings**.
{% endstep %}

{% step %}
Click **Add Dataset Role** to create a new role.

<figure><img src="/files/xd6CUU0MhDPN8VsBChot" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Enter a **name** for the role.
{% endstep %}

{% step %}
Select the **permissions** the role should have.

<figure><img src="/files/D32urQrEXgM0pSVHbfVz" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click **Save** to apply your changes.
{% endstep %}
{% endstepper %}

### Edit Dataset Roles

You can edit dataset roles at any time to adjust permissions as your organization’s needs evolve.

To edit a dataset role:

{% stepper %}
{% step %}
Go to the **Dataset Roles** section in **Settings**.
{% endstep %}

{% step %}
Find the dataset role you want to modify.
{% endstep %}

{% step %}
Click the context menu next to the role and select **Edit Dataset Role**.

<figure><img src="/files/y3qncRJQR9Oqg4xBLuqV" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Adjust the role’s **name** and **permissions** as needed.
{% endstep %}

{% step %}
Click **Save** to apply your changes.
{% endstep %}
{% endstepper %}

### Assign dataset responsibilities

**Responsibilities** in Soda Cloud define who has access to a dataset and what they are allowed to do. They are assigned by mapping **users** or **user groups** to a **dataset role.**

This ensures that the right people have the appropriate permissions for each dataset, such as the ability to manage checks, propose new rules, or view profiling information.

For example:

* Assign a **Manager** role to a dataset owner who needs full control.
* Assign a **Viewer** role to a business user who only needs to monitor data quality results.

By assigning responsibilities, you ensure clear access control, accountability, and governance across your datasets.

Learn about how to set up responsibilities on a dataset: [Dataset Attributes & Responsibilities](/dataset-attributes-and-responsibilities.md)

### Define default responsibilities

#### For the dataset owner

Soda Cloud allows you to define **default responsibilities** for the dataset owner, which will automatically be granted for all dataset owners. This ensures that all users have a consistent baseline level of access unless you choose to customize it.

By default, all dataset owners have the "Manager" role.

**How to Configure Default Responsibilities**

{% stepper %}
{% step %}
Go to the **Organization Settings** page in Soda Cloud.
{% endstep %}

{% step %}
Locate the **Datasets Roles** section.
{% endstep %}

{% step %}
Select the **dataset role** to assign to the Dataset Owners

<figure><img src="/files/ouhv3dwYCLpx7H9UDq02" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click **Save** on the top right of the page to apply changes

<figure><img src="/files/KoswwTewxpAhJVYF4mGz" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

#### **For everyone**

Soda Cloud allows you to define **default responsibilities** for the **Everyone** group, which will automatically apply to all newly onboarded datasets. This ensures that all users have a consistent baseline level of access unless you choose to customize it.

By default:

* The **Everyone** group is assigned as a "Viewer" for all new datasets.
* This setting applies to **all users** in your organization unless disabled.

You can either customize the default role or **disable** the default responsibilities if you do not want the Everyone group to receive any automatic access to new datasets.

**How to Configure Default Responsibilities**

{% stepper %}
{% step %}
Go to the **Organization Settings** page in Soda Cloud.
{% endstep %}

{% step %}
Locate the **Datasets Roles** section.
{% endstep %}

{% step %}
Select the **dataset role** to assign to the Everyone group for new datasets.
{% endstep %}

{% step %}
To disable default responsibilities, toggle the feature **off**.

<figure><img src="/files/84xcGOBirc1ecRWnZgVR" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
Click **Save** on the top right of the page to apply changes

<figure><img src="/files/KoswwTewxpAhJVYF4mGz" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

***

## Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) in Soda Cloud ensures that users can only access and interact with data according to their assigned roles; roles and permissions are fully customizable to adapt to your organization's needs.

RBAC is designed to:

* Enforce least-privilege access
* Prevent direct user-to-permission grants
* Scope access by organization and role
* Ensure that all access is authenticated and authorized

Here’s how these features can benefit your organization on the journey to governed data democratization:

#### Customizable roles and permissions

With Soda, **you can tailor access to data** to align with your specific needs. For instance, you can create a role for Product Marketing that allows the team to view sample data and propose data quality checks on particular datasets, while restricting editing capabilities on others.

If a **default role** is not quite what you're looking for, **you can easily edit its permissions** to add new capabilities.

<figure><img src="/files/0xRcbIL5NoSTKaa9msUR" alt="" width="375"><figcaption></figcaption></figure>

#### Streamlined user management

You can **enable user group synchronization from your Identity Provider (IdP) to Soda Cloud**, reducing the administrative burden of ensuring consistent permissions. This saves time during onboarding and offboarding while minimizing human error.

#### Bulk editing for enhanced efficiency

You can assign roles and permissions to multiple datasets in one go through Soda Cloud UI or via [API](broken://pages/35f6a3d29f47259ce552d7bad6bb2b5f7477c480#get-api-v1-datasets-datasetid-responsibilities).

<figure><img src="/files/wV5oqlIyBPqcDzGjRKZH" alt="" width="563"><figcaption></figcaption></figure>

### Architecture

#### Strong identity as the security perimeter

Access to critical systems is federated via an Identity Provider (IdP) with:

* Multi-factor authentication (MFA) enforcement
* Role-based access control (RBAC)
* Unique user identification
* Least-privilege, role-scoped permissions

Roles are:

* Managed centrally in the IdP
* Mapped to system permissions

User group synchronization from the IdP to Soda Cloud is supported to streamline onboarding and offboarding while minimizing human error.

#### Authentication and enforcement

Every request to Soda Cloud:

1. Is authenticated
2. Is scoped to the user’s organization
3. Passes through RBAC enforcement

{% hint style="info" %}
Soda Cloud does **not** provide a capability to publish content or files that can be accessed by users who are not authenticated members of the organization. Public link sharing and anonymous access capabilities are not allowed to **prevent exposure of Soda Cloud content outside the authenticated organization**.
{% endhint %}

### **How access control helps data democratization**

Access control empowers data owners to efficiently manage data requests while ensuring that data is accessible.

* **Accelerates value creation** by enabling quick access to a wide range of dataset
* **Improves decision making** by ensuring users can easily identify and use the most relevant data

***

{% if visitor.claims.plan === 'datasetStandard' %}
{% hint style="success" %}
You are **logged in to Soda** and seeing the **Dataset Standard license** documentation. Learn more about [Documentation access & licensing](/reference/documentation-access-and-licensing.md).
{% endhint %}
{% endif %}

{% if visitor.claims.plan === 'enterprise' %}
{% hint style="success" %}
You are **logged in to Soda** and seeing the **Team license** documentation. Learn more about [Documentation access & licensing](/reference/documentation-access-and-licensing.md).
{% endhint %}
{% endif %}

{% if visitor.claims.plan === 'enterpriseUserBased' %}
{% hint style="success" %}
You are **logged in to Soda** and seeing the **Enterprise license** documentation. Learn more about [Documentation access & licensing](/reference/documentation-access-and-licensing.md).
{% endhint %}
{% endif %}

{% if !(visitor.claims.plan === 'enterprise' || visitor.claims.plan === 'enterpriseUserBased' || visitor.claims.plan === 'datasetStandard') %}
{% hint style="info" %}
You are **not logged in to Soda** and are viewing the default public documentation. Learn more about [Documentation access & licensing](/reference/documentation-access-and-licensing.md).

If you do have a Soda license, make sure to **log in to Soda Cloud in this same browser**.
{% endhint %}
{% endif %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.soda.io/organization-and-admin-settings/global-and-dataset-roles.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.