Create Custom Roles

Design and create custom roles tailored to your organization's specific needs.

Role Design Process

Step 1: Identify Need

Questions to ask:

What job function needs access?
What should they be able to do?
What should they NOT be able to do?
Is this temporary or permanent?

Step 2: Get Permission Template

GET /authz/api/v1/roles/template

Review available permissions.

Step 3: Create Role

POST /authz/api/v1/roles

Example: Dashboard Editor

{ "name": "dashboard-editor", "description": "Can create and edit dashboards but not publish to production", "permissions": [ "dashboard.create", "dashboard.edit", "dashboard.view", "catalog.view" ] }

Example: Pipeline Monitor

{ "name": "pipeline-monitor", "description": "View pipelines and runs, can trigger manual runs", "permissions": [ "pipeline.view", "pipeline.execute", "pipeline.run.view" ] }

Step 4: Test Role

# Assign to test user PUT /admin/api/assign-client-roles { "userId": "test-user", "roles": ["dashboard-editor"] } # Verify permissions GET /authz/api/v1/users/permissions?userId=test-user

Step 5: Deploy to Production

# Assign to appropriate groups PUT /admin/api/assign-client-roles { "groupId": "group-dashboard-team", "roles": ["dashboard-editor"] }

Common Custom Roles

Auditor Role:

{ "name": "auditor", "permissions": ["*.view", "audit.read", "log.read"] }

Data Steward:

{ "name": "data-steward", "permissions": ["catalog.certify", "catalog.tag", "metadata.edit"] }

Pipeline Operator:

{ "name": "pipeline-operator", "permissions": ["pipeline.view", "pipeline.execute", "pipeline.monitor"] }

APIs Used

GET /authz/api/v1/roles/template - Get permissions
POST /authz/api/v1/roles - Create role
GET /authz/api/v1/roles/:roleId - View role details
PUT /admin/api/assign-client-roles - Assign role

Last updated on

Was this page helpful?