Skip to main content
Product access enables a kind of work. Resource access determines what you can do to a particular resource. Clearance is another required check.

​
Account and product responsibilities

A person can hold several roles. Seats, product access, authoring and resource grants remain distinct.

​
Resource access groups

Execution also checks dependencies, source reach, clearance and limits. A Reader cannot use a workflow to perform a write they lack authority to make. Review requires the current assignment and subject access. No resource group alone supplies a review decision.

​
Teams and defaults

Team Lead manages team membership. Member receives grants assigned to that team. Teams do not nest. Direct and team grants combine to the person’s highest applicable access group. To revoke access, inspect both routes. The workspace creator receives Owner. The selected team receives its intended workspace grant; creation does not expose the workspace to every team. A workspace reaching a dataset through a collection supplies Reader access to that dataset. Updates and ingestion need a Contributor grant on the dataset itself.

​
Assign and verify

In Console, set the person’s required product access and Forge-author flag. On the resource, grant the intended group directly or through a named team. Check clearance before adding a member. After saving, inspect the person’s effective access and one representative operation. Billing-team changes do not grant resource access. Use Manage workspace access and clearance for the procedure and Grant privileged authority and audit scope for privileged operations.