> For the complete documentation index, see [llms.txt](https://v2.dataos.info/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://v2.dataos.info/operate/v1/tenant-admin/governance.md).

# Manage access

## Manage access

Your governance work is the day-to-day grant management that lets a team build safely: who can use which Compute and data source, who is in the Tenant, and how deployed products run under a stable identity. The mechanics are in the [Access control](/operate/v1/access-model.md); this page is what you do with them.

### Onboard users and assign roles

Use the **Tenant Admin** application to find users in the Instance and assign Tenant roles (Data Developer, Data Consumer, Data Admin). This lets you onboard people without an operator handling each request.

1. Open the **Tenant Admin** application.
2. Find the user in the Instance (they must be able to sign in to the Instance first).
3. Assign the Tenant role that fits their responsibility.

Guidelines:

* Assign the narrowest role that fits.
* Keep role design consistent with the operator's conventions so access is predictable.

For role definitions and the capability matrix, see [Roles & Permissions](/operate/v1/access-model.md).

### Grant someone access

This is the grant you will issue most. By default a developer holds no access to Compute, Depots, Minerva, or Secrets; each needs an explicit `Can Use` grant before it can be referenced in a Data Product workload. To let a developer build on a shared Compute or data source:

1. Open the resource's **Access** tab (or your Tenant Admin app view of it).
2. Grant the developer (or a role) **Can Use**.

The three grant levels:

* `Can Use`: reference a resource in a Data Product workload.
* `Can Edit`: change the resource.
* `Can Manage Access`: grant it onward to others.

Prefer granting to a role over individuals where the access is standard for that role.

{% hint style="info" %}
You hold `Can Manage Access` on every resource in the Tenant by default, including ones you did not create, so you can grant access even when the creator has left. You do **not** hold `Can Use` by default; to use a resource yourself, self-grant `Can Use`. That self-grant is audited like any other.
{% endhint %}

### Revoke access

When access is no longer needed (a project ends, a person moves teams, or a product is retired), revoke the grant from the same **Access** tab. Revoking `Can Use` stops new Data Product workloads from referencing the resource; Data Product workloads already running should be migrated or stopped as part of the change.

### Governance practices

* **Grant to roles, review individuals.** Standard access goes to a role; one-off grants to individuals should be reviewed periodically.
* **Track ApplicationUser grants.** They let resources act as another identity; know which exist and revoke when a product is retired.
* **Act on orphaned resources.** When a creator leaves, use your elevated privilege to reassign or clean up their resources so operations stay stable.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://v2.dataos.info/operate/v1/tenant-admin/governance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.