User Permissions and RBAC

​

User Permissions and RBAC

Under Settings > Users & Roles, you can view the roles associated with each user, as well as whether those roles are granted directly or via SCIM. When adding new users to your Chalk environment, you can assign them roles that will determine their permissions in the environment. The available roles in order of increasing permissions are:

• Viewer: Read the web portal and create new alerts.
• Data Scientist: Run queries, branch deploy, + everything that a Viewer can do.
• Developer: Run queries, run migrations + everything that a Data Scientist can do.
• Admin: Create deployments, service tokens, and secrets + everything that a Developer can do.
• Owner: Manage team members + everything that an Admin can do.

Customers with Enterprise Features can also configure datasource and feature-level RBAC (Role Based Access Control). Under Settings > Access Tokens, you can create and manage service tokens that can be used for RBAC. On the datasource level, you can restrict a token to only access data sources with matching tags to resolve features. On the feature level, you can restrict a token’s access to tagged features either by blocking the token from returning tagged features in any queries but allowing the feature values to be used in the computation of other features, or by blocking the token from accessing tagged features entirely.

​

Denylisting vs Allowlisting Tags

When configuring feature-level RBAC, you can use either denylisting or allowlisting approaches to control access to tagged features:

• Denylist: Users with a denylist configuration will be allowed to query all feature tags except those specifically blocked in the denylist. This is a permissive approach where access is granted by default, and only explicitly listed tags are restricted.

• Allowlist: Users with an allowlist configuration will be denied access to query all feature tags except those specifically specified in the allowlist. This is a restrictive approach where access is denied by default, and only explicitly listed tags are permitted.