Requirements for Common Tasks

Completing Control Hub tasks requires a combination of roles and permissions. The following sections list the requirements to complete common Control Hub tasks.

Note: Remember that users with the Organization Administrator role can complete all tasks and have full permissions on all objects.

Data Collector Tasks

The following table lists the role and permission requirements to complete common Data Collector tasks:

Task Roles Permissions
Assign labels to a Data Collector. Any Write on Data Collector
Deactivate a registered Data Collector. Auth Token Administrator Not applicable
Register a Data Collector. Auth Token Administrator Not applicable
Unregister a Data Collector. Auth Token Administrator Not applicable
View the details of a Data Collector. Any Read on Data Collector

Data Protector Tasks

The following table lists the roles and permissions required to complete Data Protector tasks:
Task Role Permission
View and manage classification rules, including creating, editing, and deleting rules, as well as committing and sharing rules. Classification Administrator None required
View and manage protection policies, including creating, editing, and deleting policies, as well as setting the default policies for the organization. Policy Manager None required
Assign policies to jobs Job Operator Read on the pipeline

Execute on the policy

Start jobs with specific policies Job Operator Read on the pipeline

Execute on the policy

Data SLA Tasks

The following table lists the role and permission requirements to complete common data SLA tasks:

Task Roles Permissions
Acknowledge a triggered data SLA alert in the Alerts view. Notification User

Data SLA User or Editor

Read on data SLA
Activate or deactivate a data SLA. Data SLA Editor

Topology User or Editor

Job Operator

Pipeline User or Editor

Time Series Reader

Execute on data SLA

Read on topology

Read on all jobs in topology

Create a data SLA. Data SLA Editor

Topology User or Editor

Job Operator

Pipeline User or Editor

Time Series Reader

Read on topology

Read on all jobs in topology

Delete or edit a data SLA. Data SLA Editor

Topology User or Editor

Job Operator

Pipeline User or Editor

Time Series Reader

Write on data SLA

Read on topology

Read on all jobs in topology

View a data SLA within the topology. Data SLA User

Topology User or Editor

Job Operator

Pipeline User or Editor

Time Series Reader

Read on data SLA

Read on topology

Read on all jobs in topology

Job Tasks

The following table lists the role and permission requirements to complete common job tasks:

Task Roles Permissions
Create a job for a pipeline. Job Operator

Pipeline User or Editor

Read on pipeline
Delete a job. Job Operator Write on job
Edit a job. Job Operator

Pipeline User or Editor

Write on job

Read on pipeline

Export a job. Job Operator

Pipeline User or Editor

Read on job
Import a job. Job Operator

Pipeline Editor

Not applicable
Monitor a job. Job Operator

Pipeline User or Editor

Time Series Reader

Read on job

Read on pipeline

Read on all Data Collectors with the assigned labels

Reset the origin for a job. Job Operator

Pipeline User or Editor

Execute on job

Read on pipeline

Upload an initial offset file for a job. Job Operator

Pipeline User or Editor

Write on job
Start, stop, and synchronize a job. Job Operator

Pipeline User or Editor

Execute on job

Read on pipeline

Execute on all Data Collectors with the assigned labels

Pipeline Tasks

The following table lists the role and permission requirements to complete common pipeline tasks:

Task Roles Permissions
Create and remove tags for a pipeline. Pipeline Editor Write on pipeline
Delete a pipeline version from the pipeline repository. Pipeline Editor Write on pipeline
Download a pipeline from Control Hub to Data Collector. Engine Creator or Administrator Read on pipeline
Create a new pipeline in the Control Hub Pipeline Designer, including performing data preview and explicit validation and publishing the pipeline. Pipeline Editor

Engine Creator or Administrator

Job Operator

Not applicable
Select the authoring Data Collector for a pipeline in Pipeline Designer. Pipeline Editor

Engine Creator or Administrator

Job Operator

Write on the pipeline

Read on the Data Collector

Configure a pipeline in Pipeline Designer, including performing data preview and explicit validation and publishing the pipeline. Pipeline Editor

Engine Creator or Administrator

Job Operator

Write on pipeline
Export a pipeline. Pipeline User or Editor Read on pipeline
Import a pipeline. Pipeline Editor Not applicable
Publish a pipeline from Data Collector. Pipeline Editor For the first publish - read on pipeline within Data Collector.

For each additional publish - read on pipeline within Data Collector and write on pipeline within Control Hub.

View configuration details and version history. Pipeline User or Editor Read on pipeline

Pipeline Fragment Tasks

The following table lists the role and permission requirements to complete common pipeline fragment tasks:
Task Roles Permissions
Create and remove tags for a fragment. Pipeline Editor Write on fragment
Delete a fragment version from the pipeline repository. Pipeline Editor Write on fragment
Create a new fragment in the Control Hub Pipeline Designer, including publishing the fragment. Pipeline Editor

Engine Creator or Administrator

Job Operator

Not applicable
Select the authoring Data Collector for a fragment in Pipeline Designer. Pipeline Editor

Engine Creator or Administrator

Job Operator

Write on the fragment

Read on the Data Collector

Configure a fragment in Pipeline Designer, including publishing the fragment. Pipeline Editor

Engine Creator or Administrator

Job Operator

Write on fragment
Use a fragment in a pipeline Pipeline Editor Read on fragment

Write on pipeline

Export a fragment. Pipeline User or Editor Read on fragment
Import a fragment. Pipeline Editor Not applicable
View configuration details and version history. Pipeline User or Editor Read on fragment

Provisioning Tasks

The following table lists the role and permission requirements to complete common provisioning tasks:

Task Roles Permissions
Create a deployment. Provisioning Operator Not applicable
Delete and edit an inactive deployment. Provisioning Operator Write on deployment
Delete a Provisioning Agent from Control Hub. Provisioning Operator Write on Provisioning Agent
Scale, start, and stop a deployment. Provisioning Operator Execute on deployment
View deployment configuration details. Provisioning Operator Read on deployment
View Provisioning Agent configuration details. Provisioning Operator Read on Provisioning Agent

Report Tasks

The following table lists the role and permission requirements to complete common reporting tasks:

Task Roles Permissions
Create a report definition.

Reporting Operator

Not applicable
View a report definition.

Reporting Operator

Read on report definition
Edit a report.

Reporting Operator

Write on report definition
Generate a report.

Reporting Operator

Execute on report definition
View a generated report.

Reporting Operator

Read on report definition

Scheduler Tasks

The following table lists the role and permission requirements to complete common tasks for scheduled tasks in the Control Hub scheduler:

Task Roles Permissions
Create a scheduled task for a job. Scheduler Operator

Job Operator

Execute on job

Create a scheduled task for a report. Scheduler Operator

Reporting Operator

Execute on report definition
View and monitor a scheduled task. Scheduler Operator Read on scheduled task
Edit a scheduled task. Scheduler Operator Write on scheduled task
Pause, resume, kill, or delete a scheduled task. Scheduler Operator Execute on scheduled task

Subscription Tasks

The following table lists the role and permission requirements to complete common subscription tasks:

Task Roles Permissions
Create a subscription. Notification User Not applicable
View a subscription. Notification User Read on subscription
Manage a subscription - including editing, enabling, disabling, and deleting a subscription. Notification User Write on subscription

Topology Tasks

The following table lists the role and permission requirements to complete common topology tasks:

Task Roles Permissions
Create a topology. Topology Editor Not applicable
Delete topology versions. Topology Editor

Job Operator

Pipeline Editor

Write on topology
Export a topology. Topology User or Editor

Job Operator

Pipeline User or Editor

Read on topology
Import a topology. Topology Editor

Job Operator

Pipeline Editor

Not applicable
Map jobs and systems in a topology. Topology Editor

Job Operator

Pipeline Editor

Write on topology

Read on all jobs in topology

Read on all pipelines in topology

Monitor a topology. Topology User or Topology Editor

Job Operator

Pipeline User or Editor

Time Series Reader

Read on topology

Read on all jobs in topology

Read on all pipelines in topology

View a topology. Topology User or Topology Editor

Job Operator

Pipeline User or Editor

Read on topology

Read on all jobs in topology

Read on all pipelines in topology