Multiple-Schema Permissions

This page describes the permissions required for each step of the multi-schema source datastore creation flow. For the full reference of user roles and how they compare, see User Roles.

Role Requirements

All steps in the multi-schema workflow require the Manager role (or higher: Admin). This is enforced at the endpoint level - users who hold only the Member user role, or only the Editor team permission, cannot access the multi-schema flow.

Team Permissions

In addition to the role requirement, team-level permissions are enforced when datastores are created. This is the same rule that applies to creating a single datastore:

• The user must have Editor permission in at least one of the teams assigned to the new datastores.
• Having Editor in at least one assigned team is sufficient. Membership in every assigned team is not required. Admins bypass this team-permission check.
• If no teams are specified, the datastore is assigned to the public team, so the user must have Editor permission on the public team for the creation to succeed.

Connection Permissions

There are no connection-level permissions for schema discovery. Any user with the Manager role can discover catalogs and schemas from any connection in the workspace - the only gate is the role requirement.

Permission Flow Summary

graph TD
    A[User initiates multi-schema flow] --> B{Has Manager role?}
    B -->|No| C[Access denied]
    B -->|Yes| D[Discover catalogs & schemas]
    D --> E[Validate selected schemas]
    E --> F[Bulk create datastores]
    F --> G{User has Editor permission<br/>in assigned teams?}
    G -->|No| H[Creation fails:<br/>Insufficient permissions]
    G -->|Yes| I[Datastores created successfully]
    I --> J{Link enrichment?}
    J -->|Yes| K{Member role +<br/>Editor team permission?}
    K -->|No| M[Link fails:<br/>Insufficient permissions]
    K -->|Yes| L[Enrichment linked]
    J -->|No| L
    L --> N[Done]

UI Behavior Without Permission