DataAgent provides users with flexible permission control capabilities. Combined with the user and permission management features of BytePlus's privatized Management Center, it enables permission control for users at both the system and product levels. This document introduces the permission control capabilities of DataAgent.

Typically, the BytePlus primary account that activates DataAgent serves as the system administrator account (admin) with the highest permissions. The system administrator can create sub-accounts for the privatized portal based on the team's business needs, add them to DataAgent users, and grant more granular DataAgent resource permissions (including project resource permissions and agent permissions) through DataAgent's permission control.

Permission control granularity #

DataAgent includes product-level control, project resource permission control, and agent permission control. The scope of permissions for each level of control is described as follows.

Key points for user authorization #

When DataAgent manages user permissions for products, projects, and agents, users can be categorized as administrator users and regular users.

View permission details #

Users can view permission details, obtain permission-related information, and determine whether permissions are effective.

• Project-related permissions can be viewed on the "Project Center" - "User Authorization" page.
• Agent-related permissions can be viewed on the "Agent Configuration" - "Basic Information" page.

General authorization operations #

Authorization methods #

DataAgent provides users with multiple authorization methods for different resources:

• Project resource authorization methods
  • User Management: Add a single user and grant initial permissions to the user.
  • By User Authorization: Suitable for granting single-point authorization to individual users.
  • User Group Management: Suitable for granting the same operation permissions to multiple users.
  • Resource-Based Authorization: Suitable for authorizing users or user groups based on resources.
• Agent resource authorization methods
  • Detailed Explanation of User Permissions: Suitable for adding administrators or members to an agent.

Authorization operations #

For detailed permission information and authorization steps for each resource, see Detailed Explanation of User Permissions.

Practical scenario: Authorization chain recommendations #

• Path 1: Grant object operation permissions directly to users

  
  1. Create IAM sub-accounts. The system administrator (primary account) logs in to BytePlus and creates sub-accounts on the IAM Access Control page, which are BytePlus system users. For details, see User Management.

     warning

     After the system administrator creates a sub-account, there is no need to authorize the sub-account on the IAM access control page.

  2. Add system users to the DataAgent product. The system administrator (primary account) goes to the DataAgent "System Management" - "User Management" page, searches for the IAM sub-account (system user), and adds it as a DataAgent product user.
  3. Grant project and agent-related permissions. The project administrator grants project resource-related permissions (project, dataset, visual modeling, data connection) to the product user, and the agent administrator grants agent resource (agent only) permissions to the product user.
     • To quickly use an agent, the user must have both agent usage permission and view permission for the dataset configured for that agent (this is the minimum permission requirement). For detailed instructions, see the documentation.
     • To view, edit, or manage a project or datasets, visual modeling, data connections within the project, or to perform advanced operations such as configuring agents, the user must have the corresponding project and agent permissions. For detailed instructions, see Detailed Explanation of User Permissions.

• Path 2: Grant permissions to users in bulk via user groups when authorizing project resource objects

1. Create user groups. The system administrator creates user groups on the IAM Access Control page, which are system-level user groups. For details, see User Management.
2. Add users to user groups. The system administrator adds users to user groups on the IAM Access Control page.
3. Associate user groups. The project administrator creates a new user group in the product by associating a system-level user group from the "User Group List" on the "Project Center" - "User Group Management" page.

   warning

   • Here, project administrators can only create user groups in DataAgent by associating system-level user groups. System-level user groups are user groups set in BytePlus Access Control.
   • To adjust system-level user group members, system administrators must add or remove users on the IAM access control page.
4. Grant permissions to user groups. Project administrators grant project or dataset permissions to user groups in the "Project Center" – "User Group Management" page under "Permission Management". For details, see User Group Management.

Practical scenarios: Fine-grained data access control #

In addition, for data permissions in DataAgent datasets, the product also provides a more fine-grained control method—row-level and column-level permission control, which allows control over user access to specific rows or columns in a dataset. For details, refer to Detailed Explanation of User Permissions.

In actual business scenarios, data permissions (that is, row-level and column-level permissions) play a critical role. They precisely define the boundaries of user access to data content, ensuring that data is used appropriately under secure and controllable conditions. The specific scenario-based applications are as follows:

• Enterprise department collaboration: For datasets associated with the agent for the sales department, row permissions restrict Sales representatives to viewing only sales data rows for the regions or customers they are responsible for, while column permissions only expose relevant columns such as sales amount and hide sensitive financial columns such as cost, ensuring compliant data usage.
• Financial risk control: For the customer information dataset of a banking agent, row permissions allow loan officers to view only the application data rows for the customers they are responsible for, while column permissions only expose basic information columns to regular loan officers. Sensitive columns such as asset details are restricted to senior risk control personnel, ensuring data security.
• Medical data applications: For the medical record dataset of a hospital agent, row permissions are divided by department, so doctors can only view medical record rows for patients in their own department. Sensitive columns such as genetic test results are restricted to specific teams through column permissions, balancing privacy protection and research needs.