> ## Documentation Index
> Fetch the complete documentation index at: https://support.entegrata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permission dependencies

> See which permissions only work together with another permission, so the roles you build grant everything a task needs.

Some permissions only work when a role also grants another one. For example, a user with **Update** on **Manage Silver Entities** still can't save an entity unless they can also update the pipeline it belongs to.

Use the tables below when you build a role, or when a user has a permission but the related button is missing, disabled, or fails when they use it. Feature names match the [permission matrix](/administration/user/roles-and-permissions.md#feature-reference). **All records** means the permission applies to every connection or pipeline, not to specific records.

> [!NOTE]
>
> The permission matrix turns on a group's top-level feature, such as **Instance Settings**, and **Admin App Access** when you grant any permission inside the group. It doesn't add **Read** when you grant **Update**, so add both where a table lists both.

## Data Connections

| To do this | You need | Also needed |
| - | - | - |
| Open any page of a connection | **Manage Data Connections**: Read on that connection | Without it, the page shows as not found |
| See a connection you just created | **Manage Data Connections**: Create | **Manage Data Connections**: Read on the new connection, and **Manage Data Connection Resources**: Read to see its tables. Creating a connection doesn't grant access to it. |
| View a connection's tables, routes, or files | **Manage Data Connection Resources**: Read | **Manage Data Connections**: Read on that connection |
| View a resource's collection page | **Manage Data Connection Resources**: Read | **Manage Data Connections**: Read on that connection |
| Open the **Auth** tab | **Manage Data Connection Settings**: Read | **Manage Data Connections**: Read on that connection |
| Edit a connection's authentication details | **Manage Data Connections**: Update on that connection | **Manage Data Connection Settings**: Read, to open the **Auth** tab |
| Open a connection's collection settings | **Manage Data Connection Settings**: Update | **Manage Data Connections**: Read on that connection |
| Attach a schedule in collection settings | **Manage Data Connection Settings**: Update | **Manage Data Connections**: Update |
| **Trigger Deletion** or **Trigger Sync** in collection settings | **Manage Data Connections**: Update on that connection | **Manage Data Connection Settings** or **Manage Data Connection Resources**: Update, to open the settings |
| View the **Schedules** page | **Manage Data Connection Settings**: Read | **Manage Data Connections**: Read |
| Create, edit, or delete a schedule | **Manage Data Connection Settings**: Update | **Manage Data Connections**: Create, Update, or Delete, matching the action |
| View a connection's **Emission** tab | **Manage Data Connection Settings**: Read | **Manage Data Connections**: Read on that connection |
| Create or edit an emitter on a connection | **Manage Data Connections**: Update on that connection | None |
| Delete an emitter | **Manage Data Connections**: Update on that connection | **Manage Data Connections**: Delete |

**Manage Data Connection Settings** and **Manage Data Connection Resources** apply to every connection. They only take effect on connections the user can also read under **Manage Data Connections**.

## Data Pipelines

| To do this | You need | Also needed |
| - | - | - |
| Open a pipeline | **Manage Production Pipelines** or **Manage Dev Pipelines**: Read on that pipeline | Without it, the pipeline shows as not found. The `main` pipeline always uses **Manage Production Pipelines**. |
| Save, publish, or reset an entity, or revert it to a snapshot | **Manage Silver Entities** or **Manage Gold Entities**: Update | Update on the pipeline the entity belongs to |
| Revert a change from the entity history | **Manage Silver Entities** or **Manage Gold Entities**: Update | Update on the pipeline |
| Sync an entity to another pipeline | **Manage Silver Entities** or **Manage Gold Entities**: Update | Update on the target pipeline |
| Add or edit a map on a gold entity | **Manage Gold Entities**: Update | **Manage Silver Entities**: Update. Without it, saving the map fails. |
| Use the row actions on an entity with access control | Permissions on the entity's layer | **Manage Access Control Entity Rules**: Update. Without it, the row menu is empty. |
| Sync a pipeline | Update on that pipeline | **Manage Silver Entities**: Update |
| **Sync from Main** | **Manage Production Pipelines**: Read on all records | **Manage Silver Entities**: Update, and Update on the target pipeline |
| Duplicate a pipeline | Update on the pipeline you duplicate | None. Create isn't required. |
| View the **Metrics** library | **Manage Metrics**: Read | Read on the pipeline |
| View **Emissions** in a pipeline | **Manage Data Connections**: Read on all records | Without it, you're sent back to the pipeline |
| Create an emitter from a pipeline | **Manage Data Connections**: Update on all records | Update on the pipeline |
| Edit an emitter from a pipeline | Update on the pipeline | **Manage Data Connections**: Update on that emitter's connection |

## Instance Settings

| To do this | You need | Also needed |
| - | - | - |
| Use any instance settings card | Update on the card's feature | Read on the same feature. Without Read, the card is hidden. |
| Open the network connections list | **Manage System Network Connection**: Update | **Manage System Network Connection**: Read |
| Add a network connection | **Manage System Network Connection**: Create | **Manage System Network Connection**: Update. Without it, saving fails. |
| Open the firewall rules page | **Manage Firewall Rules**: Update | **Manage Firewall Rules**: Read |
| Add a firewall data source or policy | **Manage Firewall Rules**: Create | **Manage Firewall Rules**: Update. Without it, saving fails. |
| **Apply Changes** to firewall rules | **Manage Firewall Rules**: Update | **Manage System Version**: Read and Update |
| Save **Lakehouse IP Access** | **Manage Databricks IP Access**: Update | **Manage System Version**: Read and Update. Without them, applying the change fails. |
| Save the instance timezone | **Instance Settings**: Access | **Manage System Version**: Update |

## Access Control

| To do this | You need | Also needed |
| - | - | - |
| Use the **Groups** or **Users** pages | **Manage Access Control Groups**: Read | **Manage Production Pipelines**: Read on the `main` pipeline, and **Manage Silver Entities**: Read. Without them, the page says a production pipeline or mapped entities are required. |
| Create a group | **Manage Access Control Groups**: Create | **Manage Access Control Groups**: Update |
| Use the **Filters** tab when creating a group | **Manage Access Control Groups**: Create and Update | **Manage Production Pipelines**: Read and **Manage Silver Entities**: Read |
| **Test Permissions** on a group | **Manage Access Control Groups**: Read | **Manage Access Control Entity Rules**: Read |
| Create a rule | **Manage Access Control Entity Rules**: Create | **Manage Access Control Entity Rules**: Update |
| Pick users or groups in a rule | **Manage Access Control Entity Rules**: Create or Update | **Manage Access Control Groups**: Read. Without it, the picker stays empty. |
| Pick specific resources in a rule | **Manage Access Control Entity Rules**: Create or Update | **Manage Access Control Entity Rules**: Read. Without it, the picker stays empty. |
| Use subject or resource filters in a rule | **Manage Access Control Entity Rules**: Create or Update | **Manage Production Pipelines**: Read and **Manage Silver Entities**: Read |
| **Test Permissions** on the rules page | **Manage Access Control Entity Rules**: Read | **Manage Access Control Groups**: Read, for the subject picker |
| Change a default permission | **Manage Access Control Entity Rules**: Update | **Manage Access Control Entity Rules**: Read, to load the current value |
| Edit **Display Fields** | **Manage Production Pipelines**: Update on the `main` pipeline | **Manage Silver Entities**: Update. **Manage Access Control Entity Rules** isn't used. |
| Open the **Data Sources** pages | **Access Control**: Access | **Manage Access Control Entity Rules**: Read |
| Create a data source configuration | **Manage Access Control Entity Rules**: Create | **Manage Access Control Entity Rules**: Update |
| Open a data source's collection settings | **Manage Data Connections**: Read on that connection | **Manage Data Connection Resources**: Read to load them. To save, **Manage Data Connection Settings**: Update and **Manage Data Connection Resources**: Update. |

## Application Permissions

| To do this | You need | Also needed |
| - | - | - |
| Assign or revoke a user's roles | **Manage Users**: Update | None |
| Save a user's edited permissions as a new role | **Manage Users**: Update | **Manage Roles**: Create |
| Duplicate a role | **Manage Roles**: Create | None |

## Troubleshooting

> [!TIP]
>
> If a user has a permission but the feature still doesn't work, find the task in the tables above and check that their roles grant everything in the **Also needed** column. Remember that roles are additive: the user needs the permission from at least one assigned role. Changes take effect within about a minute.

## Related documentation

> **[Roles and permissions](/administration/user/roles-and-permissions.md)**
>
> Create roles and assign them to users

> **[Troubleshooting](/administration/user/troubleshooting.md)**
>
> Common issues and solutions for user management


## Related topics

- [Roles and permissions](/administration/user/roles-and-permissions.md)
- [Testing Permissions](/data/access_control/testing-permissions.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.