Confidential project

For projects with high permission requirements, where you do not want users from other departments to view the project space.

• Only the project administrator can add members.
• The project can only be found in the project search box by the project administrator.

Non-confidential project

The project can be made public within the organization.

Users can search for the project and contact the project administrator to request to join.

Control mode

Can create

Who has management permissions

Can the administrator grant permissions to others

Can create

Who has management permissions

Can the administrator grant permissions to others

Standard mode

✅

The creator is the default administrator.

✅

✅

The creator is the default administrator.

✅

Moderate mode

✅

The creator is the default administrator.

❌

✅

The project administrator is the default administrator, and the creator has edit permissions.

✅

Strict mode

❌

--

❌

✅

The project administrator is the default administrator, and the creator has edit permissions.

✅

Search list

Whether the permissions for the project can be found in the top navigation project options list.

• Only the top search bar is available in the private deployment environment.
  
• In the SaaS environment, in addition to the searchable top navigation bar mentioned above, you can also search on the homepage. If you do not have permission, the option can be grayed out.

Note:

• It is necessary to distinguish between confidential and non-confidential projects.
• Sort by app_id in ascending order.

No permission. #

No permission to view the project.

View #

Permission to access and enter the project, with the following permissions:

• Can view resources within the project for which you have permission.
• Can create personal dashboards or folders and perform other operations.
• Can create public dashboards or folders in public folders where you have edit permission.
• Cannot create public folders or public dashboards in the root directory of public folders.
• Can create folders or datasets in folders where you have edit permission.
• Cannot create folders or datasets in the root directory of datasets.
  Note:
• Project view permission plus edit permission for a specific public folder allows creation of public folders or dashboards in that public folder.
• An error will occur after clicking Confirm when creating in the root directory.

Edit #

Includes the above view permissions, and also includes:

• Can create public dashboards, public folders, or datasets in the root directory.
• Can create user attributes.
  Note:
• Dashboards can only be created in public folders where you have edit permission.
• Datasets can only be created in folders where you have edit permission.

Global view #

Includes the above edit permissions, and also includes:

• Can view all public dashboards, public dashboard folders, and datasets within the project, and view all data.
• Can view all personal dashboards via personal dashboard links, but the dashboard list will not display all personal dashboards.
  Note:
• Dashboards can only be created in public folders where you have edit permission.
• Datasets can only be created in folders where you have edit permission.

Manage #

• Can manage permissions for all resources within the project (the private deployment version also supports project deletion).
  Note:
• You can create dashboards in all public folders

Project administrator proactively assigns permissions

1. Project Center - User Management - Add user, assign project permissions
2. Project Center - Permission Management, assign project permissions to target user

Project administrator

Obtain project permissions by acquiring other resources

Other users grant Xiaoming permissions for dashboard/dataset/visual modeling tasks. When Xiaoming logs in, project read permission is acquired automatically

Resource administrator

Obtain by joining a user group

Add the user to the xxx user group, and configure project permissions in the Permission Management tab of the user group details

User group/Project administrator

1. Not applicable if group authorization blocking is enabled
2. There will be a delay for both granting and revoking user group authorization

Obtain by joining a role

Add the user to the xxx role, and configure project permissions in the Permission Management tab of the role details

Role/Project administrator

1. Not applicable if group authorization blocking is enabled

List display permission

Items displayed in the dashboard module left-side list

View only #

1. Can view data
2. Chart function buttons: Can create monitoring tasks
3. Dashboard function buttons: Can create new subscription [personal only], add bookmark, embed dashboard, and more
4. Cannot perform download or copy data operations on charts

View #

Includes the above view-only permissions, and also:

1. Chart function buttons: Copy, download data
2. Dashboard function buttons: Add to favorites, export image

Edit #

Includes the above view permissions, and also:

1. Edit basic information and view dashboard access statistics
2. Editable dashboard: Add components, delete charts, adjust layout, set linkage, configure jump, and more within the canvas
3. Charts can be edited [requires dataset view permission]
4. Charts can be copied on the dashboard edit page [requires dataset view permission]

Manage #

Includes the above editing permissions, and also:

1. Manage permissions and transfer ownership
2. Advanced subscription [individual/group]
3. Move, copy, delete dashboards, and other operations

Resource/project administrator proactively grants permissions #

1. Single resource authorization dialog in the upper right corner of the resource [applies to both individual and public dashboards]

The single resource authorization dialog can grant permissions to any member, user group, role, or Lark group within the project

2. Project center - resource permissions [applies to both individual and public dashboards]

In resource permissions, click authorize/permission management to grant permissions to others

3. Project center - permission management [applies only to public dashboards, only project administrators can operate]

In permission management, select the target user and grant dashboard permissions

Resource administrator [methods 1 and 2]
Project administrator [methods 1, 2, and 3]

Obtain by joining a user group #

Add the user to the xxx user group, and configure the target dashboard in the permission management tab of the user group details [applies only to public dashboards]

User group/project administrator

1. User group administrators can only configure public dashboards for which they have management permissions
2. The member list of department user groups cannot be configured and is automatically adapted by the organizational structure
3. Not applicable if group authorization blocking is enabled
4. There will be a delay for both user group authorization and deauthorization

Permissions can be obtained by adding role members. #

Add the user to the xxx role, and configure the target dashboard in the Permissions Management tab of the role details [only applicable to public dashboards].
Configure the resource permissions for the role, and set the role members.


Caution: The prerequisite is that a resource administrator or higher role must first authorize the role in the dashboard; only then will the resource permission category appear in role management.

Role/project administrator

1. Role administrators can only configure public dashboards for which they have management permissions
2. Not applicable if group authorization blocking is enabled
3. Special case: Folders without permissions will also be displayed, but when selected for authorization, a prompt indicating no permission will appear.
   

Inherited through folder permissions #

Dashboard permissions are obtained by inheriting permissions from the dashboard folder

• Resource folders are authorized directly; dashboards within the folder are authorized by default.

• Project Center - Permissions Management
  
• Project Center - Resource Management
  

Folder/project administrator

For inheritance logic, see the folder section below

List display permission

Items displayed in the left-side list of the dataset module****

View only #

1. Can view data
2. Can favorite datasets
3. Can view dataset details (data preview, model information, lineage view)
4. Can query and add temporary fields on the visual query page
5. Chart function button: "Copy to dashboard" operation [requires view-only permission for the dashboard as well].
6. Cannot download or copy data on charts.

View #

Includes the above view-only permissions, and also includes:

1. Can copy data on the visual query page
2. Can download, configure monitoring, and perform other operations on the visual query page
3. On the dashboard editing page: Copy chart [dashboard editing permission is also required]

Edit #

Includes the above view permissions, and also includes:

1. Ability to edit basic dataset information
2. Ability to create usage instructions, configure visual query settings, and set tags
3. Ability to modify dataset models, perform routine configurations, and other operations
4. Ability to copy datasets [dataset connection permission is also required]

Manage #

Includes the above edit permissions, and also includes:

1. Ability to manage permissions and transfer owner
2. Ability to move or delete datasets and other operations
3. Ability to configure row and column permissions

Resource/project administrator proactively grants permission #

1. Single resource authorization pop-up in the upper right corner of the resource

The single resource authorization pop-up can grant permissions to any member, user group, role, or Lark group within the project

2. Project center - resource permissions

In resource permissions, click Authorize/Permission Management to grant permissions to others

3. Project center - permission management [project administrators only]

In permission management, select the target user and grant dataset permissions

Resource administrator [methods 1 and 2]
Project administrator [methods 1, 2, and 3]

Obtained by joining a user group #

Add the user to the xxx user group, and configure the target dataset in the user group details - permission management tab

User group/project administrator

1. User group administrators can only configure datasets for which they themselves have management permissions
2. The member list of department user groups cannot be configured and is automatically adapted by the organizational structure
3. If group authorization blocking is enabled, this does not apply
4. There will be a delay for both granting and revoking user group permissions

Obtain permissions by adding role members #

Add the user to the xxx role, and configure the target dataset in the role details - permission management tab
Configure the resource permissions for the role and set role members


Caution: The prerequisite is that a resource administrator or higher role must first authorize the resource; only then will the resource permission category appear in role management.

Role/project administrator

1. Role administrators can only configure datasets for which they have management permissions
2. Not applicable if group authorization shielding is enabled
3. Special case: Folders without permissions will also be displayed, but when selected for authorization, a no-permission prompt will appear
   

Inherited through folder permissions #

Permission to dashboards is inherited by obtaining permission to the dashboard folder

• Folders on the resource are authorized directly, and datasets within the folder are authorized by default

  

• Project center - permission management

  

• Project center - resource management

  

Folder/project administrator

Inheritance logic

Row permissions #

Control which rows of a certain field xxx user(s) can or cannot view

1. Configuration methods include fixed value and dynamic value
   1. Fixed value
      
   2. Dynamic value (used with user attributes)
      
2. Blocklist/allowlist configuration—only affects row permissions, not column permissions
   1. Only effective for row permissions, not for column permissions.
   2. Off: Only users on the configured list can view the data; the visible range is determined by the configured rules. Users not on any list cannot view any data.
   3. On: Users on the list are restricted and can only view data within the configured rules. Users not on the list can view all row data.
      
3. And/or rule configuration

Column permissions #

Restrict viewing of a particular column in the dataset to specified users only.

1. Configurable on model (base table) fields / dataset fields
   1. If a sensitive column field is configured on a model field, all dataset fields derived from that model field will be affected.
   2. If a sensitive column field is configured on a dataset field, it affects controlled users viewing that dataset field, but does not affect controlled users viewing the corresponding model field.
      

View

• Allows viewing of the data connection
• Allows selecting this data connection when creating a new dataset

Edit

In addition to the above view permission, allows editing the information of the data connection.

Manage

In addition to the above edit permission, allows modifying the authorization of the data connection.