Data Catalog Links Permissions

Data Catalog Links use two independent layers of access control in Qualytics, User Roles (platform-level) and Team Permissions (datastore-level). A user may need to satisfy both layers to perform certain actions. For the canonical matrix of every team-permission-gated action, see Team Permissions Overview.

Two Permission Systems

User Roles (Member, Manager, Admin) control what a user can do across the platform. Team Permissions (Reporter, Viewer, Drafter, Author, Editor) control what a user can do on the specific datastores they reach through team membership. They are independent systems with different scopes.

User Roles (Platform-Level)

Action	Member	Manager	Admin
View an asset's catalog links
Link, change, or unlink an asset (with the Editor team permission)
Start a datastore-scoped synchronization (with the Editor team permission)
Start a full integration synchronization

Team Permissions (Datastore-Level)

Every change to a datastore's catalog links is gated by the team permission on that datastore. Viewing only requires reaching the datastore, which any team permission grants, starting at Reporter.

Action	Reporter	Viewer	Drafter	Author	Editor
View the datastore's catalog links
Link, change, or unlink an asset
Search the catalog's assets when linking
Start a datastore-scoped synchronization

How Both Layers Work Together

To link, change, or unlink an asset, or to start a datastore-scoped synchronization, a user must satisfy both layers:

User Role: at least Member
Team Permission: Editor on the datastore

To start a full integration synchronization, covering every datastore of the integration, a user needs the Manager or Admin role. The run still covers only the datastores where that user has the Editor team permission, and it reports how many were skipped for lack of it. An Admin covers every datastore. To sync every datastore of the integration as a Manager, grant Editor on each of them. A full synchronization also reconciles the lineage connections between datastores of the integration as a whole, so a Manager's run can remove a connection that involves a datastore it skipped. See Synchronization.

Admin Bypass

Users with the Admin role bypass team-level permission checks and can manage any datastore's catalog links.

UI Behavior Without Permission

Scenario	What the User Sees
User is below the Editor team permission	The dialog opens read-only. The Link an asset, Change asset, and Unlink controls are hidden, and so is the Sync button.
User is below the Manager role	The full synchronization is unavailable on the integration's entry under Settings > Integrations; the datastore-scoped Sync in the dialog still works with the Editor team permission.

Important Notes

Containers and fields inherit the gate: their catalog link actions are checked against the datastore they belong to. There is no container-level or field-level permission for catalog links.
Viewing is not restricted by link mode: manual and automatic links are visible to anyone who can open the asset; only changes are gated.