Following are the core policies that the authorization module follows. Detailed policies for entities are listed in the table after that. For new entities and entities not listed here, these core policies should be followed.
- Create needs a WRITE on the parent
- Delete needs an ADMIN on the entity
- Delete all deletes all entities the user has privileges for and shows errors for the ones not deleted.
- List needs a READ on the parent. It lists all entities even if the user has no privilege on the entity, as long as they have read on the parent.
- Get needs a READ on the entity
- Setting preferences needs WRITE on the entity
- Getting preferences needs READ on the entity
- Update needs ADMIN on the entity
- Adding metadata needs ADMIN on the entity
- Reading metadata needs READ on the entity
| Entity | Operation | Required Privileges | Resultant Privileges | Notes |
|---|---|---|---|---|
| Namespace | create | WRITE (Instance) | ALL (Namespace) | |
| update | ADMIN (Namespace) | |||
| list | READ (Instance) | Listing will list all the namespaces, even if the current user does not have access too to it. | ||
| get | READ (Namespace) | |||
| delete | ADMIN (Namespace) | |||
| set preference | WRITE (Namespace) | |||
| get preference | READ (Namespace) | |||
| search | READ/WRITE/ADMIN/ALL (Namespace) | |||
| Artifact | add | WRITE (Namespace) | ALL (Artifact) | |
| delete | ADMIN (Artifact) | |||
| get | READ (Artifact) | |||
| list | READ (Namespace) | |||
| write property | ADMIN (Artifact) | |||
| delete property | ADMIN (Artifact) | |||
| get property | READ (Artifact) | |||
| write metadata | ADMIN (Artifact) | |||
| read metadata | READ (Artifact) | |||
| Application | deploy | WRITE (Namespace) | ALL (Application) | |
| get | READ (Application) | |||
| list | READ (ApplicationNamespace) | |||
| update | ADMIN (Application) | |||
| delete | ADMIN (Application) | |||
| set preference | WRITE (Application) | |||
| get preference | READ (Application) | |||
| add metadata | ADMIN (Application) | |||
| get metadata | READ (Application) | |||
| Programs | start/stop/debug | EXECUTE (Program) | ||
| set instances | ADMIN (Program) | |||
| list | READ/WRITE/ADMIN/ALL (Application) | |||
| set runtime args | ADMIN (Program) | |||
| get runtime args | READ/WRITE/ADMIN/EXECUTE/ALL (Program) | |||
| get instances | READ /WRITE/ADMIN/EXECUTE/ALL(Program) | |||
| set preference | ADMIN WRITE (Program) | |||
| get preference | READ (Program) | |||
| get status | READ/WRITE/ADMIN/EXECUTE/ALL (Program) | |||
| get history | READ/WRITE/ADMIN/EXECUTE/ALL (Program) | |||
| add metadata | ADMIN (Program) | |||
| get metadata | READ (Program) | |||
| emit logs | WRITE  (ProgramNamespace) | |||
| view logs | READ (Program) | |||
| emit metrics | WRITE (ProgramNamespace) | |||
| view metrics | READ (Program) | |||
| Streams | create | WRITE (Namespace) | ALL (Stream) | |
| update properties | ADMIN (Stream) | |||
| delete | ADMIN (Stream) | |||
| truncate | ADMIN (Stream) | |||
| enqueue asyncEnqueue batch | WRITE (Stream) | |||
| get | READ/WRITE/ADMIN/ALL (Stream) | |||
| list | READ/WRITE/ADMIN/ALL (Namespace) | |||
| read events | READ (Stream) | |||
| set preferences | ADMIN WRITE (Stream) | |||
| get preferences | READ (Stream) | |||
| add metadata | ADMIN (Stream) | |||
| get metadata | READ (Stream) | |||
| view lineage | READ (Stream) | |||
| emit metrics | WRITE (StreamNamespace) | |||
| view metrics | READ (Stream) | |||
| Datasets | listcreate | READ/WRITE/ADMIN/WRITE (Namespace) | ALL (Dataset) | |
| get | READ/WRITE/ADMIN/ALL (Dataset) | |||
| createlist | WRITE READ (Namespace)ALL (Dataset) | |||
| update | ADMIN (Dataset) | |||
| drop | ADMIN (Dataset) | |||
| truncate | ADMIN (Dataset) | |||
| upgrade | ADMIN (Dataset) | |||
| add metadata | ADMIN (Dataset) | |||
| get metadata | READ (Dataset) | |||
| view lineage | READ (Dataset) | |||
| emit metrics | WRITE (DatasetNamespace) | |||
| view metrics | READ (Dataset) |