Roles & Permissions

NQRust Analytics ships with three system roles: admin, editor, and viewer. This page lists the exact permissions each one grants, derived from the seeded role definitions.

Permission matrix

Permissions are resource:action pairs. The table below shows which actions each role holds for each resource. A check means the role has that resource:action permission.

admin

The admin role grants every action on every resource — there are no gaps.

editor

The editor role grants read and write on the data and modeling resources. It has no delete or admin actions, and no access to user or role.

viewer

The viewer role grants read-only access to projects and data. It has no write, delete, or admin actions, and no access to user, role, sql_pair, or instruction.

Summary

• viewer — can look at projects, models, views, query threads, and dashboards, but cannot change anything.
• editor — everything a viewer can do, plus creating and modifying models, views, queries, threads, dashboards, SQL pairs, and instructions. An editor cannot delete via the delete permission and cannot touch user or role administration.
• admin — full control of the instance, including managing users and roles (user:* and role:*), which no other role has.

System roles

All three roles are flagged as system roles in the database. The application blocks editing or deleting a system role: attempts to update or delete one are rejected ("Cannot modify system roles" / "Cannot delete system roles"). Administrators can still create additional custom roles with their own permission sets alongside these built-ins.

Next steps