Role Limitations and Examples

Organization Roles

• Organization Super Admin: Full read and write access to all resources and configurations in the account — org, all workspaces, and all projects.
• Organization Admin: Configure settings at the org level but no project access.
• Organization Governance Admin: Create and manage policies, and assign them to apps in the organization.
• Governance Reader: Views policy details, violations, and compliance history for accessible apps; auto-granted with Workspace Reader, Project Reader, Workspace Admin, and Workspace Policy Manager.
• Governance Operator: Same read access as Governance Reader, plus re-runs compliance checks and submits attestations; auto-granted to Project Admin.
• Organization Reader: View organizational settings; no workspace/project data access.
• Organization Read All: Full read-only access across organization, workspaces, and projects.
• Organization Member: Minimal read access that allows a user to view the basic Arthur UI.
• System Administrator: Configures org-level settings and creates/manages/assigns governance policies (Organization Admin + Organization Governance Admin combined).

Workspace Roles

• Workspace Super Admin: Full read and write access to all resources and configurations in a workspace and its projects.
• Workspace Admin: Configure workspace settings; no organization-level control.
• Workspace Policy Manager: View, create, and edit all org policies; assign, unassign, and delete policies within the workspace; read-only compliance/attestation data outside it.
• Workspace Read All: Read-only access to all workspace projects and resources.
• Workspace Reader: View workspace configurations; no access to project data.
• Custom Aggregation Manager: Read and write access to all custom aggregations in a workspace.
• Engine Manager: Create and configure engines in the workspace.
• Engine Workspace: Access to resources in the workspace that an engine needs to execute jobs in it.

Project Roles

• Project Admin: Manage project-level resources and datasets. Can view the raw data of datasets.
• Project Reader: View project resources; no edit permissions. Does not grant access to raw dataset data.
• Data Plane Project: Grants access needed by a data plane for job execution for an associated project.

Multi-Scope Roles (bindable at org, workspace, or project level)

• Raw Data Reader: Read access to view raw dataset data within the bound scope.
• Data Plane Execution: Read access to dequeue jobs from the data plane's job queue and view its own configuration.