Data Reconciliation Recipe Permissions

The Data Reconciliation recipe has no permissions of its own. Each step performs an ordinary platform action, and that action's permissions apply. The check is created and activated like any check, the scan and the materialize are ordinary operations, and the anomaly is acknowledged or archived like any anomaly. This page gathers those requirements in one place. For the canonical matrices, see User Roles and Team Permissions.

Two Permission Systems

User Roles (Member, Manager, Admin) control what a user can do across the platform. Team Permissions (Reporter, Viewer, Drafter, Author, Editor) control what a user can do on the specific datastores they reach through team membership. They are independent systems with different scopes.

User Roles (Platform-Level)

Every role can use the recipe. No step is reserved for Managers or Admins.

Action	Member	Manager	Admin
Open Recipes and browse a recipe's steps
Receive AI suggestions and analyses
Create and activate the check
Run the scan
Write the keep and remove sets
Acknowledge or discard the anomaly

Each of these still requires the matching team permission, listed below.

Team Permissions (Datastore-Level)

Most permissions are checked on the left datastore, the one holding the asset you investigate: the check is created on it, the scan and the materialize run on it, and the keep and remove sets are written to its enrichment destination. The right datastore only needs to be readable.

Action	Reporter	Viewer	Drafter	Author	Editor
Browse the recipe's steps and pick assets on either side
Receive AI suggestions and analyses
Use an asset as the reference (right datastore)
Load the scan's mismatched rows (Scan, Reconcile)
Create the Draft check (Review)
Save and activate the check (Validate)
Run the scan (Scan)
Write the keep and remove sets (Materialize)
Acknowledge or discard the anomaly (Materialize)
Create a computed asset from Select Assets (as owner)
Create a computed asset from Select Assets (any owner)

Completing the recipe end to end

The scan and the materialize are operations, and running operations needs the Editor team permission. A user with Editor on the left datastore and at least Reporter on the right datastore can complete the whole recipe alone. A Drafter can build the check, and an Author can also activate it, but both need an Editor to run the scan and write the keep set.

How Both Layers Work Together

To take two assets all the way to a keep set, a user must satisfy both layers:

User Role: at least Member
Team Permission: Editor on the left datastore, and Reporter or above on the right datastore

The AI suggestions follow the same rule as viewing: any team permission on the datastores involved, plus the Member role. Whether a given AI step is available at all depends on the AgentQ data sharing level, not on the user's permissions. See AgentQ Access Controls.

Admin Bypass

Users with the Admin role bypass team permission checks and can complete the recipe on any pair of datastores.

UI Behavior Without Permission

Scenario	What the User Sees
User cannot dry-run checks on the left datastore (below Drafter)	Reconcile in Recipe is not shown on the anomaly details. The recipe itself still opens from the Recipes page, but on Review it can neither check for a conflicting check nor create the Draft check, and shows a permission error.
User is below Viewer on the left datastore	The Scan step cannot load the mismatched rows, so reconciliation cannot start.
User cannot run operations on the left datastore (below Editor)	Scan in Recipe is not shown on the check details. Inside the recipe, Scan and Materialize fail with a permission error, and you can try again once the permission is granted.
User cannot read the right datastore	The reference asset cannot be selected, and validation of a loaded check fails.
User cannot create computed assets on a datastore	The Computed Table (or Computed File) and Computed Join cards are not shown in that column; only Existing Table is offered.
AgentQ data sharing level below what a step needs, or no AI answer	The step reports that its AI suggestions could not load and lets you continue manually.
No AI provider configured	No AI banners appear anywhere in the recipe, and the Get AI suggestions offer on Reconcile is absent. Every step works manually.

Important Notes

The check is an ordinary check. Once the recipe has created it, editing, cloning, archiving, or scheduling it from the datastore page follows the usual quality check permissions.
Entering from a check or an anomaly checks the same permissions as building the recipe from scratch. The entry-point buttons are hidden when you lack them; see Entry Points and Resuming.
Masked fields stay masked. The recipe never asks to reveal masked values. Fields masked on either asset appear masked in the mismatch explorer and are written masked to the keep and remove sets, whatever your team permission.