Understanding role-based access control in Dagster+#

Role-based access control (RBAC) enables you to grant specific permissions to users in your organization, ensuring that Dagster users have access to what they require in Dagster+, and no more.

In this guide, we'll cover how RBAC works in Dagster+, how to assign roles to users, and the granular permissions for each user role.

Dagster+ Pro user roles#

Dagster+ Pro employs a flexible approach to user roles and permissions. This system is built on two fundamental concepts:

1. Permission scope - Permissions are context-specific, falling into two main categories:
   • Organization-wide settings (for example, "Create Teams")
   • Deployment-specific actions (for example, "Launch and Cancel Backfills")
2. Role types - Dagster+ supports two types of roles:
   • Default roles: Hierarchical roles, based on sensible defaults provided by Dagster.
   • Custom roles: Roles you define with specific sets of permissions to match your organization's needs.

Teams#

Dagster+ Pro users can create teams of users and assign default permission sets. Refer to the Managing teams in Dagster+ guide for more info.

Creating custom roles#

1. Navigate to the Organization Settings page.
2. Click the Roles tab.
3. Click the Create new role button.
4. Select a name and icon.
5. Provide a brief description.
6. Choose deployment or organization type depending on where you want your role applied.
7. Select the permissions you want to apply to the role. Note that you can base your role off of an existing role for ease of creation.

Editing custom roles#

1. Navigate to the Organization Settings page.
2. Click the Roles tab.
3. Click the edit button next to the role you want to edit.
4. Make your changes.
5. Save your changes.
6. You will see a confirmation dialog including the changes that have been made.

Deleting custom roles#

If you no longer need a custom role, you can delete it from the edit dialog.

1. Navigate to the Organization Settings page.
2. Click the Roles tab.
3. Click the edit button next to the role you want to delete.
4. At the bottom of the edit dialog, click Delete role.

Note that if the role is currently assigned to any users, you will need to reassign them to a different role before deleting the role.

Assigning user and team roles#

Organization Admins have access to the entire organization, including all full deployments, code locations, and Branch Deployments.

For custom roles, you will have to define if the role applies to the organization settings, or deployment settings.

Applying role overrides#

As previously mentioned, you can define individual user roles for users in your organization. You can also apply permission overrides to grant specific exceptions.

Overrides may be used to apply a more permissive role. If, for example, the default role is Admin or Organization Admin, overrides will be disabled as these are the most permissive roles.

Code locations#

To override a code location role for an individual user:

1. Locate the user in the list of users.
2. Click Edit.
3. Click the toggle to the left of the deployment to open a list of code locations.
4. Next to a code location, click Edit user role.
5. Select the user role for the code location:
6. Click Save.

Team members#

Users in your organization can belong to one or more teams. When determining a user's level of access, Dagster+ will use the most permissive role assigned to the user between all of their team memberships and any individual role grants.

For example, let's look at a user with the following roles for our dev deployment:

• Team 1: Launcher
• Team 2: Viewer
• Individual: Viewer

In this example, the user would have Launcher access to the prod deployment. This is because the Launcher role is more permissive than Viewer.

The above also applies to code locations and Branch Deployment roles.

Viewing overrides#

To view deployment-level overrides for a specific user, locate the user on the Users page and hover over a deployment:

If there are code location-level overrides, a small N override(s) link will display beneath the user's deployment role. Hover over it to display the list of overrides:

Removing overrides#

1. Locate the user in the list of users.
2. Click Edit.
3. To remove an override:
   • For a deployment, click Edit user role next to the deployment.
   • For a code location, click the toggle next to the deployment to display a list of code locations. Click Edit user role next to the code location.
4. Click the Remove override button.
5. Click Save.

User permissions reference#

General#

Deployments#

Deployment settings are accessed in the UI by navigating to user menu (your icon) > Organization Settings > Deployments.

Code locations#

Code locations are accessed in the UI by navigating to Deployment > Code locations.

Agent tokens#

Agent tokens are accessed in the UI by navigating to user menu (your icon) > Organization Settings > Tokens.

User tokens#

User tokens are accessed in the UI by navigating to user menu (your icon) > Organization Settings > Tokens.

Users#

User management is accessed in the UI by navigating to user menu (your icon) > Organization Settings > Users.

Teams#

Team management is accessed in the UI by navigating to user menu (your icon) > Organization Settings > Teams.

Note: Admin users can modify teams only in deployments where they're an Admin.

Workspace administration#

Related#