Insights Permissions

Insights is a read-only view, so permissions decide what it covers rather than what you can change on it. Two layers apply. Your platform role decides whether the scope is every datastore or only the ones your teams reach, and your team permission on a datastore decides whether that datastore reports at all.

For the canonical matrix of every team-permission-gated action across the platform, see Team Permissions Overview.

What Each Role Sees

What Each Team Permission Contributes

Reporting access is the lowest team permission, and every higher permission includes it. A datastore therefore appears in Insights at any team permission, which is why the page can cover data you are not allowed to open in detail.

How Permissions Are Applied

• Scope is computed per person, not per page. Two people can open the same report date with the same filters and see different totals, because the underlying set of datastores differs. Neither reading is wrong, and neither is a stale cache.
• No access means an empty page, not an error. Someone whose teams grant no datastore access sees the page with no data and the refresh and export controls disabled. Being added to a team resolves it.
• Every action on the page is available to everyone who can see it. Export and Refresh are not gated by role or team permission. Export can still be hidden when a deployment restricts file downloads platform-wide.
• Drill-through inherits the destination's rules. Opening a filtered list from a summary card lands you on the Checks or Anomalies tab, which applies its own permissions. A count can therefore be larger than the list you are able to open from it.

Cross-Reference

For the complete workspace role matrix, see User Roles.