> ## Documentation Index
> Fetch the complete documentation index at: https://docs.validio.io/llms.txt
> Use this file to discover all available pages before exploring further.

# About Validio RBAC

> Learn how role-based access works in Validio.

Validio **Role-Based Access Control (RBAC)** provides granular, permission-based management of users and resources. By organizing users into **Teams** and segmenting resources into **Namespaces**, you can ensure data independence and secure monitoring across your organization.

## Roles and permissions

You can assign roles (Admin, Editor, Viewer, and Custom) to users and teams at the global and namespace [access levels](#resource-access-levels) to control access to different resources in Validio. Custom roles allow you to follow the *Principle of Least Privilege* to ensure users have the minimum level of access necessary to complete their specific tasks. For more information see [Managing Roles](https://docs.validio.io/v10.2/docs/access-and-settings/settings/managing-roles.md).

## Resource access levels

Roles grant combinations of READ and WRITE capabilities to resources at the global and namespace levels. WRITE permission includes READ, so the tables below list only the additional capabilities that WRITE grants on top of READ.

### Global resources

Global resources are available workspace-wide (not tied to a specific namespace). By default, all users have READ access to global resources.

| Resource | Read Capabilities | Write Capabilities |
| :- | :- | :- |
| API keys | View API keys | Create, update, regenerate, and delete API keys |
| Business glossary | View domains, glossary terms, and term assignments | Create, update, and delete domains and glossary terms |
| Catalog assets | View catalog assets and their incidents | Update catalog assets, refresh the catalog, and run data profiles |
| Classifications | View classifications | Create, update, and delete classifications |
| Saved searches | View saved searches | Create, update, and delete saved searches |
| Identity providers | View identity providers | Create, update, and delete identity providers |
| Integrations | View integrations | Create, update, and delete integrations |
| Lineage | View lineage relationships | Configure and update lineage |
| Namespaces | View namespaces | Create, update, and delete namespaces |
| Roles | View roles and role configurations | Create, update, and delete roles |
| Settings | View workspace settings | Update workspace settings |
| Tags | View tags | Create, update, and delete tags |
| Teams | View teams | Create, update, and delete teams |
| Users | View users and their role assignments | Create, update, invite, and delete users |

### Namespaced resources

Access to namespaced resources is restricted. Users can only interact with these resources if granted permission directly or through their team membership.

| Resource | Read Capabilities | Write Capabilities |
| :- | :- | :- |
| Channels | View channels in the namespace | Create, update, and delete channels |
| Credentials | View credentials in the namespace | Create, update, and delete credentials |
| Filters | View filters in the namespace | Create, update, and delete filters |
| Incidents | View incidents in the namespace | Create, update, acknowledge, and delete incidents |
| Namespace | View the namespace | Create, update, and delete namespaces |
| Notification Rules | View notification rules in the namespace | Create, update, and delete notification rules |
| Segmentations | View and preview segmentations | Create, update, and delete segmentations |
| SQL Execution | View SQL execution results | Run SQL queries |
| Sources | View sources in the namespace | Create, update, delete, start, stop, and backfill sources |
| Validators | View validators in the namespace | Create, update, copy, and delete validators |
| Windows | View windows in the namespace | Create, update, and delete windows |

## Users and teams

Teams are used to organize users into groups which you can base on business units or areas of responsibility within your organization. Different teams can configure and manage their own resources separate from other teams. For example, individual teams can see their data quality without it being affected by incidents that are happening in other teams.

For more information, see [Managing Users](https://docs.validio.io/v10.2/docs/access-and-settings/settings/managing-users-and-idps.md) and [Managing Teams](https://docs.validio.io/v10.2/docs/access-and-settings/settings/managing-teams.md).

## Namespaces

Namespaces in Validio are used to organize and isolate resources into managed groups, allowing teams to access only the resources assigned to them. This separation ensures that each team can manage its resources independently, without interference from other teams, and helps control data visibility within the Validio platform.

For more information, see [Managing Namespaces](https://docs.validio.io/v10.2/docs/access-and-settings/settings/managing-namespaces.md).