Entity Resolution Recipe Permissions

The Entity Resolution recipe has no permissions of its own. Each step performs an ordinary platform action, and that action's permissions apply. The check is created, dry-run, and activated like any check, the scan and the materialize are ordinary operations, and the anomaly is acknowledged like any anomaly. This page gathers those requirements in one place. For the canonical matrices, see User Roles and Team Permissions.

Two Permission Systems

User Roles (Member, Manager, Admin) control what a user can do across the platform. Team Permissions (Reporter, Viewer, Drafter, Author, Editor) control what a user can do on the specific datastores they reach through team membership. They are independent systems with different scopes.

User Roles (Platform-Level)

Every role can use the recipe. No step is reserved for Managers or Admins.

Action	Member	Manager	Admin
Open Recipes and browse a recipe's steps
Receive AI suggestions and analyses
Create, validate, and activate the check
Run the scan
Write the golden set
Acknowledge the anomaly

Each of these still requires the matching team permission on the source datastore, listed below.

Team Permissions (Datastore-Level)

The team permission is checked on the source datastore the selected table belongs to. The golden set is written to that datastore's enrichment destination as part of the materialize operation, so no separate permission on the destination is needed.

Action	Reporter	Viewer	Drafter	Author	Editor
Browse the recipe's steps and field metrics
Load the scan's source records for remediation (Scan, Remediate)
Receive AI suggestions and analyses
Create the Draft check (Review)
Run the dry run (Validate)
Activate the check (Validate)
Run the scan (Scan)
Write the golden set (Materialize)
Acknowledge the anomaly (Materialize)
Create a computed asset from Select Asset (as owner)
Create a computed asset from Select Asset (any owner)

Completing the recipe end to end

The scan and the materialize are operations, and running operations needs the Editor team permission. A user with Editor on the source datastore can complete the whole recipe alone. A Drafter can build and dry-run the check, and an Author can also activate it, but both need an Editor to run the scan and write the golden set.

How Both Layers Work Together

To take a table all the way to a golden set, a user must satisfy both layers:

User Role: at least Member
Team Permission: Editor on the source datastore

Admin Bypass

Users with the Admin role bypass team permission checks and can complete the recipe on any datastore.

The AI suggestions follow the same rule as viewing: any team permission on the datastore, starting at Reporter, plus the Member role. Whether a given AI step is available at all depends on the AgentQ data sharing level, not on the user's permissions. See AgentQ Access Controls.

UI Behavior Without Permission

Scenario	What the User Sees
User cannot dry-run checks on the datastore (below Drafter)	Open in Recipe and Remediate in Recipe are not shown on the check and anomaly details. The recipe itself still opens from the Recipes page, but on Review it can neither check for a conflicting check nor create the Draft check, and shows a permission error.
User is below Viewer on the datastore	The Scan step cannot load the source records, so remediation cannot start.
User cannot run operations on the datastore (below Editor)	Scan in Recipe is not shown on the check details; an active check shows Open in Recipe instead. Inside the recipe, Scan and Materialize fail with a permission error, and you can try again once the permission is granted.
User cannot create computed assets on the datastore	The Computed Table (or Computed File) and Computed Join cards are not shown on Select Asset; only Existing Table is offered.
AgentQ data sharing level below what a step needs	The step reports that its AI suggestions or recommendations could not load and lets you continue manually. The other AI steps keep working.
No AI provider configured	No AI banners appear anywhere in the recipe, and the Get AI suggestions offer on Remediate is absent. Every step works manually.

Important Notes

The check is an ordinary check. Once the recipe has created it, editing, cloning, archiving, or deleting it from the datastore page follows the usual quality check permissions.
Entering from a check or an anomaly checks the same permissions as building the recipe from scratch. The entry-point buttons are hidden when you lack them; see Entry Points and Resuming.
Masked fields stay masked. The recipe never asks to reveal masked values. They appear masked in the dry-run preview and in the remediation view, and are written masked to both outputs, whatever your team permission.