Overview

Sifflet offers a flexible access management system that allows you to customize the level at which you control access to your resources.

Role-based access control

Sifflet relies on role-based access control to ensure that only authorized individuals can access specific resources or perform specific actions. Roles can be assigned to both users and tokens.

User roles vary based on the domain, resulting in differing permissions for resources across various domains and platform configurations. Sifflet resources are classified into two distinct types:

Domain resources: These include items such as catalog and lineage assets, monitors, incidents, and their related dashboards. Typically, domain resources are grouped into domains to mirror a specific business area (such as Finance, Operations etc...) or team (Data Einngineering, Data Stewards etc...). For further details about Domains, you can refer to this documentation.
System resources: These resources, not tied to any specific domain, are used for platform administration. It includes Users, Authentication Settings, Tags, Data Sources management, Domains management, and Glossary.

Every Sifflet user receives a System Role and one or more Domain Roles based on the number of domains they are associated with.

📘
Domain "All"
In case there is no domains defined on the platform, all users will default to the "All" domain. The domain role will be enforced across all the data assets connected to the platform.

System Role

System roles define the type of access the user has to a given setting resource. Typically, these roles provide the user the right to create, edit, and delete a resource.

By default, Sifflet offers three System Roles: Admin, System Editor and System Viewer.

System Resource	Actions	Admin	System Editor	System Viewer
Integrations
Integrations management	read, create, edit, delete, trigger run	✅	✅	❌
Credentials	read name and description, use in source	✅	✅	❌
Credentials	create, edit, delete	✅	❌	❌
Glossary
Terms	read	✅	✅	✅
Terms	create, edit, delete	✅	✅	❌
Settings
Tags	read	✅	✅	✅
Tags	create, edit, delete	✅	✅	❌
Domains	read, create, edit, delete	✅	❌	❌
Users	read, create, edit, delete	✅	❌	❌
Access Tokens	read, create, delete	✅	❌	❌
SSO	read, create, edit, delete	✅	❌	❌
Collaboration Tools	read, create, edit, delete	✅	❌	❌
Tenant Preferences	read, create, edit, delete	✅	❌	❌

Domain Role

Domain roles define the type of access the user has to a given domain resource. By default, Sifflet offers four Domain Roles: Domain Editor, Monitor Responder, Catalog Editor, and Domain Viewer.

Domain resource	Action	Domain Editor	Monitor Responder	Catalog Editor	Domain Viewer
Catalog
Data assets	search through the catalog	✅	✅	✅	✅
Data assets	read	✅	✅	✅	✅
Data assets	create metadata, edit metadata, delete metadata, generate metadata	✅	❌	✅	❌
Data assets	preview data	✅	❌	✅	❌
Monitors
Monitors	read (overview, runs details, parameters details)	✅	✅	✅	✅
Monitors	create, edit, delete, run	✅	❌	❌	❌
Monitors	show failing rows	✅	✅	❌	❌
Monitors	qualify runs for ML models feedbacks	✅	✅	❌	❌
Incidents
Incidents	assign, status update, close	✅	✅	❌	❌

📘
Multiple domain access
Users may be associated to multiple domains: for example, a user can be a Domain Viewer in Domain A and a Domain Editor in Domain B.

Token Roles

Access Tokens allow you to programmatically interact with Sifflet objects through the API, CLI and Airflow Operator.

By default, Sifflet offers three Token Roles: Admin, Editor, Viewer:

Resource	Action	Admin	Editor	Viewer
Catalog
Data assets	search through the catalog	✅	✅	✅
Data assets	read	✅	✅	✅
Data assets	data preview	✅	✅	❌
Data assets	metadata edit (manual or through AI suggestions)	✅	✅	❌
Monitors
Monitor	read (overview, runs details, parameters details)	✅	✅	❌
Monitor	create, edit, delete, run	✅	✅	❌
Monitor	show failing rows	✅	✅	❌
Monitor	qualify runs for ML models feedbacks	✅	✅	❌
Incidents
Incidents	assign, status update, close	✅	✅	❌
Glossary
Terms	read	✅	✅	✅
Terms	create, edit, delete	✅	✅	❌
Integrations
Secrets management	read, create, edit, delete	✅	❌	❌
Integrations management	create, edit, delete, trigger run	✅	✅	❌
Integrations management	Submit dbt metadata files and trigger the related datasource refresh	✅	✅	❌
Integrations management	Create declarative pipeline & edge lineage	✅	❌	❌
Settings
Tags	read	✅	✅	✅
Tags	create, edit, delete	✅	✅	❌
Domains	read, create, edit, delete	✅	❌	❌
Users	read, create, edit, delete	✅	❌	❌
Access Token	read, create, delete	✅	❌	❌
SSO	read, create, edit, delete	✅	❌	❌
Collaboration Tools	read, create, edit, delete	✅	❌	❌
Account Preferences	read, create, edit, delete	✅	❌	❌

🚧
Important
Tokens use special Sifflet roles and are not domain-specific, granting access to all domains.

Access Control

Overview

Role-based access control

📘
Domain "All"

System Role

Domain Role

📘
Multiple domain access

Token Roles

🚧
Important

Overview

Role-based access control

📘Domain "All"

System Role

Domain Role

📘Multiple domain access

Token Roles

🚧Important

📘
Domain "All"

📘
Multiple domain access

🚧
Important