Table of Contents

RBAC Roles and Permissions for Data Pipelines

Learn which roles and permissions are needed to create, run, and monitor data pipelines.

Overview

Data pipelines are protected by FoundationaLLM role-based access control (RBAC). Access depends on:

  • The authorizable actions granted by the roles assigned to you (or to your groups).
  • The scope of each role assignment: the whole instance, or a specific data pipeline.
  • Two specialized roles, Data Pipelines Contributor and Data Pipelines Execution Manager, that the data pipeline resource provider checks for specific operations.

For the platform-wide list of roles, see Permissions & Roles Reference.

Authorizable actions

Action Description
FoundationaLLM.DataPipeline/dataPipelines/read Read data pipelines.
FoundationaLLM.DataPipeline/dataPipelines/write Create or update data pipelines. Also required to activate, deactivate, and run pipelines, and to work with pipeline runs.
FoundationaLLM.DataPipeline/dataPipelines/delete Delete data pipelines.
FoundationaLLM.DataPipeline/management/write Execute management actions on the resource provider.

What each operation requires

Operation Requirement
List pipelines, open a pipeline, View JSON definition dataPipelines/read
Create Pipeline The Data Pipelines Contributor role at a scope that covers the new pipeline (in practice, the instance scope). The Create Pipeline button is shown only to users with this role.
Save Changes on an existing pipeline The Data Pipelines Contributor role and dataPipelines/write on the pipeline.
Activate or deactivate (Activate column) dataPipelines/write
Run Now, Advanced run…, or trigger a run through the API dataPipelines/write
View, refresh, analyze, and cancel runs (Data Pipeline Runs page and the Last Run column) dataPipelines/write on the pipeline. Viewing runs across all pipelines (Pipeline filter set to Any) requires this permission at the instance scope.
Delete a pipeline dataPipelines/delete
Management actions (management/trigger-command) management/write and the Resource Providers Administrator role.

The Data Pipelines Contributor role is mandatory for creating and updating pipeline definitions. Owners and Contributors also need it to save a pipeline.

When you create a pipeline, FoundationaLLM assigns you the Owner role on that pipeline (unless a policy applies to the pipeline). This gives you read, write, and delete access to the pipelines you create, even if your other role assignments don't.

Roles

Role ID Data pipeline capabilities
Owner 1301f8d4-3bea-4880-945f-315dbd2ddb46 All actions, including managing role assignments. Needs the Data Pipelines Contributor role to create or update pipelines.
Contributor a9f0020f-6e3a-49bf-8d1d-35fd53058edf All actions except writing or deleting authorization resources. Needs the Data Pipelines Contributor role to create or update pipelines.
Reader 00a53e72-f66e-4c03-8f81-7e885fd2eb35 Read all resources (*/read). Can view pipelines but not their runs.
Data Pipelines Contributor 2da16a58-ed63-431a-b90e-9df32c2cae4a Required to create and update pipelines. Grants FoundationaLLM.Configuration/apiEndpointConfigurations/read, FoundationaLLM.AIModel/aiModels/read, and FoundationaLLM.Platform/plugins/read. It does not grant read access to existing pipelines or data sources.
Data Pipelines Execution Manager e959eecb-8edf-4442-b532-4990f9a1df2b Manage pipeline runs. Grants dataPipelines/read, dataPipelines/write, and read access to data sources, API endpoint configurations, AI models, plugin packages, plugins, and vector databases. Can activate, run, and monitor pipelines, but can't save pipeline definitions (without the Data Pipelines Contributor role) or delete pipelines.
Resource Providers Administrator 63b6cc4d-9e1c-4891-8201-cf58286ebfe6 Execute management actions on resource providers (*/management/write).

Capability summary

Capability Owner Contributor Reader Data Pipelines Contributor only Data Pipelines Execution Manager only
View pipelines Yes Yes Yes Only pipelines they created Yes
Create pipelines With Data Pipelines Contributor With Data Pipelines Contributor No Yes No
Update pipelines With Data Pipelines Contributor With Data Pipelines Contributor No Only pipelines they created No
Activate, deactivate, and run Yes Yes No Only pipelines they created Yes
View, analyze, and cancel runs Yes Yes No Only pipelines they created Yes
Delete pipelines Yes Yes No Only pipelines they created No

The pipeline editor lists data sources, plugins, and the resources referenced by plugin parameters (such as knowledge units, prompts, AI models, and data sources). If a user can't read those resources, the corresponding drop-downs are empty. Pipeline authors typically need, in addition to the Data Pipelines Contributor role, read access to:

  • Data sources (FoundationaLLM.DataSource/dataSources/read)
  • Knowledge units (FoundationaLLM.Context/knowledgeUnits/read)
  • Prompts (FoundationaLLM.Prompt/prompts/read), for knowledge graph stages
  • AI models and plugins (granted by the Data Pipelines Contributor role)

Assigning the Reader role at the instance scope together with Data Pipelines Contributor covers these.

Scopes

In the Management Portal, role assignments for data pipelines can be made at these scopes:

Scope Path Applies to
Instance /instances/{instanceId} All resources in the instance, including all data pipelines and the cross-pipeline view on the Data Pipeline Runs page.
Data pipeline /instances/{instanceId}/providers/FoundationaLLM.DataPipeline/dataPipelines/{pipelineName} One data pipeline and its runs.

Assignments at a parent scope are inherited by the resources under it.

Assign a role

  1. In the sidebar, select Security > Access Control.
  2. In Scope, select Instance, or select Resource and then:
    1. In Resource Provider, select FoundationaLLM.DataPipeline.
    2. In Resource Type, select dataPipelines.
    3. In Resource Name, enter the pipeline name.
    4. Select View Permissions.
  3. Select Create Role Assignment.
  4. Under What principal to assign?, select the principal type and select Browse to find the user, group, or service principal.
  5. Under What role to assign?, select the role.
  6. Select Create Role Assignment.

Users also need access to the Management Portal itself. See Management Portal Access.

For more details about the Role Assignments page, see Instance Access Control.

Common assignments

Goal Assignment
Author new pipelines and manage them Data Pipelines Contributor and Reader at the instance scope. Authors become Owner of the pipelines they create.
Edit an existing pipeline created by someone else Data Pipelines Contributor at the instance scope, plus Contributor or Owner on that pipeline.
Operate pipelines (activate, run, monitor) without changing them Data Pipelines Execution Manager at the instance scope or on specific pipelines.
Monitor all runs across pipelines A role with dataPipelines/write (for example, Data Pipelines Execution Manager) at the instance scope.
View pipeline definitions only Reader.