User Management

Role-based access control, user lifecycle management, permission matrices, and team delegation. This section is for Organization Administrators and Workspace Administrators.

On this page

Resource Hierarchy
System Roles
Functional Roles
Permission Matrix
User Lifecycle
Teams & Groups
Audit & Compliance

Resource Hierarchy

Permissions in DataKnits cascade downward through six levels. A permission granted at a higher level is inherited by all resources beneath it unless explicitly overridden at a lower level.

Level	Resource	Description	Contains
`L1`	Organization	Top-level tenant boundary. Owns billing, SSO, and IP allowlists.	Workspaces
`L2`	Workspace	Business unit or team grouping with shared environments and connections.	Projects
`L3`	Project	Logical grouping of ETL work.	Folders, Connections, Environments
`L4`	Folder	Organizational container within a project. Supports nested sub-folders.	Pipelines, Sub-Folders
`L5`	Pipeline	Individual ETL data flow definition with versioning and approval state.	Jobs, Steps, Transformations
`L6`	Job / Run	Single execution instance of a pipeline.	Logs, Metrics, Artifacts

System Roles

System roles are platform-wide and assigned by the Organization Administrator. They are not scoped to individual resources.

Principle of least privilege: Always assign the most restrictive role that still allows the user to perform their job. Use functional roles for day-to-day project access rather than elevated system roles.

Super Administrator

Unrestricted access to all organizations, workspaces, projects, and system settings.
Manages billing, licensing, and platform-wide configuration.
Can impersonate users for troubleshooting — every impersonation creates a mandatory audit entry.
Cannot be deleted. The Super Admin account must be transferred to another user before removal.

Organization Administrator

Full access within the assigned organization boundary.
Creates and manages workspaces, workspace admins, and all users within the org.
Configures SSO, MFA, password policies, and IP allowlists for the organization.
Cannot access other organizations or platform-level infrastructure settings.

Workspace Administrator

Full access within the assigned workspace.
Creates and manages projects, folders, and pipelines within the workspace.
Assigns users to projects and manages project-level roles.
Cannot modify org-level settings, SSO configuration, or billing.

Functional Roles (Resource-Scoped)

Functional roles are scoped to a specific Project, Folder, or Pipeline. A user can hold different functional roles on different resources simultaneously — for example, Developer on Project A and Viewer on Project B.

Role	Primary Scope	Key Capabilities	Key Restrictions
Project Owner	Project	All permissions within the project. Manages project membership. Can archive or delete the project.	—
Developer	Project / Folder	Creates and edits pipelines. Runs pipelines in Development and Staging environments. Submits pipelines for review.	Cannot execute in Production. Cannot publish to production without Approver sign-off. Cannot modify connection credentials.
Approver / Reviewer	Pipeline	Reviews and approves pipeline promotions from staging to production. Views full change diffs between versions.	Cannot directly edit pipelines. Cannot execute pipelines.
Executor / Operator	Project	Triggers, stops, pauses, and re-runs approved pipelines. Manages execution schedules.	Cannot modify pipeline definitions, transformations, or connections.
Analyst / Viewer	Project	Views all pipeline configurations, lineage, run history, and metrics. Can export run reports.	Cannot modify or execute anything. Connection credentials are always masked.
Connection Manager	Workspace / Project	Creates, manages, and tests connection configurations. Rotates credentials via the secret vault.	Cannot view plaintext credentials (write-only via vault). Cannot modify pipeline logic or execute pipelines.

Permission Matrix

✅ = full access ❌ = no access partial access is noted inline.

Action	Super Admin	Org Admin	WS Admin	Project Owner	Developer	Approver	Executor	Viewer
Users
Create User (Org)	✅	✅	❌	❌	❌	❌	❌	❌
Edit User Profile	✅	✅	Own only	Own only	Own only	Own only	Own only	Own only
Deactivate / Delete User	✅	✅	❌	❌	❌	❌	❌	❌
Assign Roles to User	✅	✅	WS scope	Project scope	❌	❌	❌	❌
Impersonate User	✅	❌	❌	❌	❌	❌	❌	❌
Projects
Create Project	✅	✅	✅	❌	❌	❌	❌	❌
Edit / Delete Project	✅	✅	✅	✅	❌	❌	❌	❌
View Project	✅	✅	✅	✅	✅	✅	✅	✅
Pipelines
Create / Edit Pipeline (Dev/Stage)	✅	✅	✅	✅	✅	❌	❌	❌
Edit Pipeline (Production)	✅	✅	✅	✅	❌	❌	❌	❌
Delete Pipeline	✅	✅	✅	✅	❌	❌	❌	❌
Submit Pipeline for Review	✅	✅	✅	✅	✅	❌	❌	❌
Approve / Promote to Production	✅	✅	✅	✅	❌	✅	❌	❌
Execution
Execute (Dev / Staging)	✅	✅	✅	✅	✅	❌	❌	❌
Execute (Production)	✅	✅	✅	✅	❌	❌	✅	❌
Stop / Pause Run	✅	✅	✅	✅	Own only	❌	✅	❌
Re-run Failed Job	✅	✅	✅	✅	✅	❌	✅	❌
View Run History / Logs	✅	✅	✅	✅	✅	✅	✅	✅
Connections
Create / Edit / Delete Connection	✅	✅	✅	✅	❌	❌	❌	❌
Test Connection	✅	✅	✅	✅	✅	❌	❌	❌
View Connection (masked)	✅	✅	✅	✅	✅	✅	✅	✅
Audit Logs
View Org-level Audit Logs	✅	✅	❌	❌	❌	❌	❌	❌
View Workspace Audit Logs	✅	✅	✅	❌	❌	❌	❌	❌
View Project Audit Logs	✅	✅	✅	✅	❌	✅	❌	❌
Export Audit Logs	✅	✅	✅	✅	❌	❌	❌	❌

User Lifecycle

Creating a User

Required fields: First Name, Last Name, Email Address (unique), Authentication Type (Local or SSO), and at least one initial role assignment.

Optional fields: Username (auto-generated from email if omitted), phone number for MFA, job title, department, cost centre.

After creation, the admin selects one of three provisioning methods:

Invite via Email — a tokenised invite link is sent to the user. Configurable expiry: 24 h, 48 h, or 7 days. User status is set to Pending until the invite is accepted.
Set a Temporary Password — the user must change it on first login. Status is immediately Active.
SSO Only — the user authenticates via the configured SSO provider. No local password is set.

Bulk User Import

CSV import supports up to 500 users per batch.
A downloadable CSV template with column definitions and validation rules is available in the UI.
Pre-import validation generates a per-row error report before committing — partial failures do not abort the entire import.
Post-import summary shows records created, failed, and duplicates skipped.

User Status Reference

Status	Meaning	Allowed Admin Actions
Active	User can log in and operate normally.	Edit, Deactivate, Delete, Reset Password
Inactive	Manually deactivated by an admin.	Activate, Edit, Delete
Locked	Auto-locked after consecutive failed login attempts.	Unlock, Reset Password, Delete
Pending	Invitation sent; user has not completed first login.	Resend Invite, Cancel Invite, Delete
Suspended	Temporarily blocked following a security event.	Review Security Log, Unsuspend

Deactivating vs Deleting a User

Operation	Effect on Resources	Reversible	Typical Use Case
Deactivate	All resources retained. Active sessions are terminated immediately. Login is blocked.	Yes — admin can reactivate	Employee on leave, offboarding where asset retention is required.
Delete	User record is removed. Resources are reassigned or marked orphaned per workspace policy.	No	Permanent departure, GDPR erasure request.

Last-Admin Protection: The last user holding the Admin role cannot be deactivated or deleted. Transfer admin access to another user before removing the last admin.

Teams & Groups

Teams are named collections of users that can be assigned a role at project or workspace level as a single unit. Adding a user to a team immediately grants them the team's role on all resources that team is assigned to.

A user can be a member of multiple teams simultaneously.
Effective permissions are the union of all roles held directly and through team membership.
Team membership changes take effect immediately — no re-login required.
Workspace Administrators and above can create and manage teams.

Role Delegation

A Project Owner can delegate project-scoped role assignment rights to other users within that project. Delegated users can only assign roles up to their own permission level — it is not possible to grant a role higher than what the delegating user already holds.

Audit & Compliance

Every user-related action is logged with a timestamp, acting user identity, target resource, and before/after field values where applicable.

Events captured in the audit log include:

User created, edited, deactivated, deleted, unlocked, suspended
Role assigned or revoked
Password reset (admin-initiated or self-service)
MFA device enrolled or removed
User impersonation (Super Admin only — always logged)
Session created and terminated
Failed login attempts including source IP address

Organization-level audit logs are visible only to Org Admins and Super Admins. Workspace and Project-level logs can be exported to CSV by Project Owners and above.

Self-escalation prevention: A user cannot grant themselves a role they do not already hold. A user cannot modify their own permissions or delete their own account.