Before you begin
Confirm account, tenant and active role in the account menu. Inspection requires view permission; changing records requires the specific management permission. A hidden or disabled action can reflect authorized scope; do not switch tenants to evade a denial. Work only with records in the workspace you are allowed to administer.
Procedure
- In Roles & permissions open Roles and View details.
- Inspect Permissions to identify the required capability.
- In New role or Edit role define Key, Label and minimum permissions; save and verify access with an authorized laboratory account.
Behavior and limits
The catalog describes permissions but does not prove they are assigned to the user. Platform roles belong to platform scope and custom roles remain bound to their tenant.
The unique master administrator has a specific verification for the DovaAI quota exemption. Not every administrator receives unlimited access. A visible permission cannot bypass tenant boundaries or authorize additional unrestricted superusers.
Check the effective assignment in Users after saving. The master DovaAI exemption requires the active persisted identity, active platform tenant, valid membership and selected role; provider readiness is still required.
Verify the result
After saving or confirming, reopen the detail and check the state reported by the server. Distinguish an accepted request from a completed operation and retain only minimal evidence without sensitive information. When an operation is pending, wait for its final state in the corresponding view before starting another action on the same object.
Laboratory example
Use the synthetic tenant documentation-lab and, where relevant, worker worker-demo-a. Note the previous state, perform one authorized action and compare the resulting state. These names illustrate the procedure; they do not identify production records or authorize creating cloud resources. For a review without changes, inspect the detail and cancel any open form.
If something fails
If a conflict appears, refresh the inventory and review current values before repeating. If the session expired, sign in and complete MFA when required. For a permission error, check the role and membership; for a provider error, inspect the operation and its safe message. Do not alter storage, revisions or controls to force an outcome.
Related reading
Environment context
Before using this module, confirm Tenant, Domain and Environment in the user menu. The initial environment is Development. Module, Domain and environment capabilities apply together; Production is read only without explicit authorization. Switching the selector does not move artifacts or publish or execute their data. See environments and recovery and environment promotion.
Environment permissions
Authorization combines module permissions, Domain access and environment capabilities. The current catalog contains 23 environment permissions: etl.environments.view, etl.environments.{development,test,stage,production}.{view,edit,publish,run,runtime.manage}, etl.environments.promote and etl.environments.runtime.manage. Global view and Runtime grants retain their explicit scope; a grant for one environment does not grant access to all others. Module management does not replace these capabilities.
ETL Developer can work in Development, Test and Stage and has no Production access by default. Release Manager can review all four environments and publish into Test, Stage and Production for authorized promotions; this does not grant Production editing or execution. Promotion retains preview, exact published dependencies and explicit Production approval. Custom roles can grant the required capabilities per environment. A user identity is not duplicated per environment; check the active role, membership and effective permissions.
Production Mapping, Session and Workflow editors remain read only: accepted versions arrive through promotion. Configuring existing or new Production Connections is a separate capability requiring etl.connections.manage and etl.environments.production.edit; it does not unlock those three editors or legacy read-only Connections.