Data Catalog Links Permissions

Data Catalog Links use two independent layers of access control in Qualytics, User Roles (platform-level) and Team Permissions (datastore-level). A user may need to satisfy both layers to perform certain actions. For the canonical matrix of every team-permission-gated action, see Team Permissions Overview.

Two Permission Systems

User Roles (Member, Manager, Admin) control what a user can do across the platform. Team Permissions (Reporter, Viewer, Drafter, Author, Editor) control what a user can do on the specific datastores they reach through team membership. They are independent systems with different scopes.

User Roles (Platform-Level)

Action	Member	Manager	Admin
View an asset's catalog links
Link, change, or unlink an asset (with the Editor team permission)
Start a datastore-scoped synchronization (with the Editor team permission)
Start a full integration synchronization

Team Permissions (Datastore-Level)

Every change to a datastore's catalog links is gated by the team permission on that datastore. Viewing only requires reaching the datastore, which any team permission grants, starting at Reporter.

Action	Reporter	Viewer	Drafter	Author	Editor
View the datastore's catalog links
Link, change, or unlink an asset
Search the catalog's assets when linking
Start a datastore-scoped synchronization

How Both Layers Work Together

To link, change, or unlink an asset, or to start a datastore-scoped synchronization, a user must satisfy both layers:

User Role: at least Member
Team Permission: Editor on the datastore

To start a full integration synchronization, covering every datastore of the integration, a user only needs the Manager or Admin role. No team permission is involved, since the run is integration-wide.

Admin Bypass

Users with the Admin role bypass team-level permission checks and can manage any datastore's catalog links.

UI Behavior Without Permission

Scenario	What the User Sees
User is below the Editor team permission	The dialog opens read-only. The Link an asset, Change asset, and Unlink controls are hidden, and so is the Sync button.
User is below the Manager role	The full synchronization is unavailable on the integration's entry under Settings > Integrations; the datastore-scoped Sync in the dialog still works with the Editor team permission.

Important Notes

Containers and fields inherit the gate: their catalog link actions are checked against the datastore they belong to. There is no container-level or field-level permission for catalog links.
Viewing is not restricted by link mode: manual and automatic links are visible to anyone who can open the asset; only changes are gated.