> For the complete documentation index, see [llms.txt](https://v2.dataos.info/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://v2.dataos.info/references/dataos-resources/minerva/access-control.md).

# Access control (WIP)

## Roles and permissions

Access works at two levels:

* **Tenant roles** decide who can create Minerva Clusters.
* **Resource permissions** decide who can use, edit, or manage access of Minerva Cluster.

#### Tenant roles

<table><thead><tr><th width="175.90576171875">Role</th><th>Granted by</th><th width="395.4449462890625">What it allows</th></tr></thead><tbody><tr><td>Tenant Admin</td><td>Operator</td><td>Create and manage their own Minerva Clusters</td></tr><tr><td>Data Admin</td><td>Tenant Admin</td><td>Create and manage their own Minerva Clusters</td></tr><tr><td>Data Developer</td><td>Tenant Admin</td><td>Create and manage their own Minerva Clusters</td></tr><tr><td>Data Consumer</td><td>Tenant Admin</td><td>No Minerva access unless a Minerva Cluster owner grants it</td></tr></tbody></table>

#### Resource permissions

<table><thead><tr><th width="188.14971923828125">Permission</th><th width="371.0865478515625">What it allows</th><th>Granted by</th></tr></thead><tbody><tr><td>Can Use Minerva</td><td>Query with Minerva Cluster on workbench</td><td>Minerva Cluster owner</td></tr><tr><td>Can Edit</td><td>Update or delete a Minerva Cluster</td><td>Minerva Cluster owner</td></tr><tr><td>Can Manage Access</td><td>Grant or revoke access on a Minerva Cluster</td><td>Minerva Cluster owner</td></tr></tbody></table>

> No role, including Tenant Admin, gives automatic access to another user's Minerva Cluster. Resource-level permissions must be explicitly granted by the Minerva Cluster owner.

{% hint style="warning" %}
To create a Minerva Cluster, you must also have permission to use both the depot and the compute that will be added to the cluster. Request these permissions from the relevant owners or from any user who can manage access to those resources.
{% endhint %}

## Request a tenant role

The table above shows which tenant roles can create Minerva Clusters. Use this section when you need to request a role or grant one to someone else.

* If you need the **Data Developer or Data Admin** role, ask your Tenant Admin to grant it.
* If you need the **Tenant Admin** role, ask your Operator to grant it.

To grant the Data Developer or Data Admin role, a Tenant Admin can follow these steps:

<details>

<summary>Show steps</summary>

1. From the DataOS home, click **More** and select **Tenant Admin**.

   ![](/files/uJB9fqw0Zmb4kT6GOcsk)
2. Go to the **Access** tab.

   ![](/files/bXlX92FibEyeIFiZRt6J)
3. Click **+ Grant**, search for the user, and select the appropriate role.

   ![](/files/9u5hWGx72zHalMCyRpON)
4. The user appears in the list with the assigned role.

   ![](/files/am4G4q1CMtDE7HDnyJkG)

</details>

> Once a Minerva Cluster is created, only the Minerva Cluster owner can edit, delete, or manage access to it. No other user, including the Tenant Admin or Data Admin, can act on a Minerva Cluster they do not own unless the Minerva Cluster owner explicitly grants them permission.

## Minerva permissions: What does it enable?

Once a Minerva Cluster exists, the Minerva Cluster owner controls who can interact with it and how. This section explains each resource-level permission — what it unlocks and when it makes sense to use it — so you can make the right call when granting access to your team.

### To query on Minerva cluster

#### Can Use Minerva

This permission lets a user run queries with the Minerva cluster. It is the right starting point for anyone who needs to explore or analyze data through Minerva.

If someone on your team needs access to a Minerva Cluster, grant them **Can Use Minerva** and they will be ready to start querying right away.

### To manage Minerva

#### Can Edit

This permission lets a user update the configuration of the Minerva Cluster or delete it. It is the right choice when you want a trusted collaborator to help you maintain or evolve the Minerva Cluster over time.

Grant **Can Edit** to teammates who need to make changes to the Minerva Cluster — whether that means updating the catalog, adjusting settings, or keeping things running smoothly.

### To grant permission for Minerva

#### Can Manage Access

This permission lets a user allow or deny access for others on that Minerva Cluster. It is the right choice when you want to delegate access management without handing over full ownership.

When you grant **Can Manage Access**, that person can invite others, adjust permissions, and keep the right people in the loop — so you do not have to handle every access request yourself.

To grant any of these permissions on a Minerva Cluster:

<details open>

<summary>Show steps</summary>

1. Open the Minerva Cluster and go to the **Access** tab.

   ![](/files/GJKu0dHkYRF2PFo7GiSN)
2. Click **Grant Permissions**.

   ![](/files/RTFdnYd2P7SjgS7bgfZA)
3. Search and select the user.

   ![](/files/xYv6id23CT2iBIZGDEB8)
4. Select a permission (**Can Use Minerva**, **Can Edit**, or **Can Manage Access**) and click **Grant**.

   ![](/files/RTFdnYd2P7SjgS7bgfZA)
5. The user appears in the User Permissions list with the granted permission.

   ![](/files/QSsTW8zE5Wg9s0eyw8JP)

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://v2.dataos.info/references/dataos-resources/minerva/access-control.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.