# Permissions

Source: https://userguide.qualytics.io/fields/computed-fields/deep-dive/permissions/

Access to a Computed Field is governed by two independent controls: the user's platform-level **role** (Member, Manager, Admin) and the **team permission** they hold on the parent datastore (Reporter, Viewer, Drafter, Author, Editor). Every action requires the caller to satisfy both.

For the full reference of user roles and how they compare, see [User Roles](https://userguide.qualytics.io/settings/access/users/permissions/). The [Team Permissions overview](https://userguide.qualytics.io/settings/access/teams/team-permissions/overview/) is the canonical matrix for what each team permission grants across the platform. This page mirrors that matrix for the actions specific to a Computed Field, and calls out one refinement (the Hybrid Gate) that widens the Editor-only rule for computed assets.

## Roles vs Team Permissions

- **User role**: assigned when the user is created. Every action described below requires at minimum the **Member** role. The **Admin** role bypasses every team-level check on this page. The **Manager** role does not bypass; Managers follow the same team-permission rules as Members.
- **Team permission**: assigned per user per datastore, either directly or through team membership. Computed Fields inherit their parent datastore's team permissions; there is no separate ACL at the field level.

## Action Matrix

Legend:

- Allowed The permission grants the ability to perform the action
- Not allowed The permission does not grant the ability to perform the action
- Allowed as owner The permission grants the ability only on an asset the user owns or will own (see the [Hybrid Gate](https://userguide.qualytics.io/fields/computed-fields/deep-dive/permissions/#the-hybrid-gate))

| Action on a Computed Field | Reporter | Viewer | Drafter | Author | Editor |
| --- | --- | --- | --- | --- | --- |
| **Field** |  |  |  |  |  |
| View the Computed Field (details, profile, tags, history) | Allowed | Allowed | Allowed | Allowed | Allowed |
| List Computed Fields inside a container | Allowed | Allowed | Allowed | Allowed | Allowed |
| Preview data (sample rows) | Not allowed | Allowed | Allowed | Allowed | Allowed |
| Create a Computed Field[1](https://userguide.qualytics.io/fields/computed-fields/deep-dive/permissions/#fn:hybrid) | Not allowed | Not allowed | Not allowed | Allowed as owner | Allowed |
| Edit a Computed Field[1](https://userguide.qualytics.io/fields/computed-fields/deep-dive/permissions/#fn:hybrid) | Not allowed | Not allowed | Not allowed | Allowed as owner | Allowed |
| Delete a Computed Field[1](https://userguide.qualytics.io/fields/computed-fields/deep-dive/permissions/#fn:hybrid) | Not allowed | Not allowed | Not allowed | Allowed as owner | Allowed |
| Reassign ownership (change `owner_id`) | Not allowed | Not allowed | Not allowed | Not allowed | Allowed |
| Assign tags to the Computed Field[1](https://userguide.qualytics.io/fields/computed-fields/deep-dive/permissions/#fn:hybrid) | Not allowed | Not allowed | Not allowed | Allowed as owner | Allowed |
| **Operations** |  |  |  |  |  |
| View activity, operations, logs, and results | Allowed | Allowed | Allowed | Allowed | Allowed |
| Trigger a profile, scan, or materialize operation on the container | Not allowed | Not allowed | Not allowed | Not allowed | Allowed |
| **Quality Checks** |  |  |  |  |  |
| View quality checks that target the Computed Field | Allowed | Allowed | Allowed | Allowed | Allowed |
| Create a draft quality check | Not allowed | Not allowed | Allowed | Allowed | Allowed |
| Save a new check as draft, or restore an archived check to draft | Not allowed | Not allowed | Allowed | Allowed | Allowed |
| Create or edit an active quality check | Not allowed | Not allowed | Not allowed | Allowed | Allowed |
| Activate or validate a quality check | Not allowed | Not allowed | Not allowed | Allowed | Allowed |
| Archive or delete a quality check | Not allowed | Not allowed | Not allowed | Allowed | Allowed |
| **Anomalies** |  |  |  |  |  |
| View anomalies on the Computed Field | Allowed | Allowed | Allowed | Allowed | Allowed |
| View anomaly source records | Not allowed | Allowed | Allowed | Allowed | Allowed |
| Change anomaly status (Acknowledge / Archive) | Not allowed | Not allowed | Not allowed | Allowed | Allowed |
| Add a comment to an anomaly | Not allowed | Allowed | Allowed | Allowed | Allowed |

Users with the **Admin** role bypass every entry in this table and can perform every action regardless of their team membership.

## The Hybrid Gate

Create, Edit, and Delete of a Computed Field follow a **hybrid gate** that widens the Editor-only rule for regular (non-computed) fields. The caller either holds **Editor** on the parent datastore, or holds **Author** and is the field's current owner (for Edit and Delete) or will be its owner (for Create, when `owner_id` is omitted or set to their own user id). The relaxation lets Authors govern the Computed Fields they own without needing full Editor on the datastore.

Three consequences worth remembering:

- An Author cannot create a Computed Field and assign it to another user in the same request. The create is allowed only when `owner_id` is omitted or set to the Author's own user id.
- Reassigning ownership after the fact (setting `owner_id` to a different user on Update) always requires **Editor**, even when the caller is the current owner.
- Ownership does not extend to running operations. Profiling, scanning, and materializing an asset stay on the **Editor** team permission, so an Author who owns an asset can change its definition but cannot run it.

The Hybrid Gate applies to computed assets (Computed Fields, Computed Tables, Computed Files, Computed Joins). Regular fields on a container continue to require Editor uniformly for Create, Edit, and Delete.

---

1. Computed Fields (and other computed assets) also honor a **Hybrid Gate**: an **Author** may Create the Computed Field when `owner_id` is omitted or set to their own user id, and may Edit, Delete, or assign tags to a Computed Field they currently own. Editor bypasses this gate. See the section below.

*Last updated: October 30, 2026.*