Role-Based Access Control
Resource and action permissions — how DataHub authorizes console and API access.
DataHub uses resource + action RBAC. Permissions are checked per resource (e.g. plants, rules, dashboards) and action (e.g. create, read, update, delete).
Authorization is not based on role name strings like "ADMIN" in application code — roles are configurable permission maps.
Resources
Valid resources include: plants, machines, devices, tags, rules, alarms, dashboards, programs, channels, users, templates, maintenance, inventory, wms, telemetry, settings, roles, audit, ops, assets, screens, catalog, platform.
Actions
Valid actions: create, read, update, delete, acknowledge, share, start, stop, adjust, export.
Permission strings combine action letters, e.g.:
crud— full create/read/update/deleter.ack— read + acknowledgecrud.share— full access plus share linkscrud.start.stop— full access plus start/stop programs
Deny wins over allow
Roles can define denied actions that override grants. Example: *.delete denies delete on all resources; users.* denies all user management.
System roles
Four seeded system roles provide default permission maps:
| Role | Typical use |
|---|---|
| ADMIN | Full platform access including users, roles, audit |
| OPERATOR | Day-to-day operations; no delete on most resources; no user/role management |
| VIEWER | Read-only across operational data |
| ENGINEER | Device/rule/program configuration with broader write access |
Custom roles can be created in Users → Roles with a permission matrix.
Plant scope
Users can be assigned to a specific plant. List queries and mutations are scoped to that plant — operators at Site A cannot see Site B data.
UNS path filter
Optional UNS path filter limits which tag paths a user can browse in UNS Explorer, enabling area-level access within a plant.
Frontend and backend
- Backend: Every mutation and sensitive read checks
@RequirePermission(resource, action)and plant scope - Frontend: Buttons and forms are gated with
can(resource, action)for UX — backend always re-validates
See Permissions reference for the full matrix.