Permissions & Access Control

Govern access for agents and humans with fine-grained RBAC using Infino. Control what data both AI agents and human users can query across your data sources.

Unified Permissions: Access control applies consistently to:

• Human users querying via UI or API
• AI agents making programmatic queries
• External integrations and tools

Security Overview

All API operations require authentication. Users can only access data and resources within their own account.

Core Concepts

User

An individual person or AI agent with credentials to access the system.

• Human users: Analysts, developers, admins using UI or API
• AI agents: Programmatic access via service accounts
• Identity: Unique username + credentials (password or API keys)
• Roles: Users are assigned one or more roles that define their permissions

Role

A set of permissions defining what operations can be performed on what resources.

• Custom roles: Define specific permission sets with YAML/JSON
• Assignment: Users are assigned roles via the Roles field
• Deny-by-default: Users with no roles have no access

Account

Your organization's Infino workspace. Contains your users, connections, roles, and data.

Permission Model

Your Account
  ├── Role: data-analyst (Permissions: read logs-*, metrics-*)
  │   └── Users: analyst@company, query-agent (AI)
  ├── Role: data-engineer (Permissions: read/write *, create/delete *)
  │   └── Users: engineer@company
  └── Root User: admin (unrestricted access)

Hierarchy: Users → Roles → Permissions → Resources

---

Permission Levels

Account-Level

• What it controls: Authentication and account boundaries
• Scope: All data sources, datasets, and connections
• Use case: Ensures users only access resources within their account

Index/Table-Level (dataset)

• What it controls: Access to specific indices or tables
• Scope: Both Infino datasets and datasets in your existing sources
• Actions: create, delete
• Use case: Restrict creation/deletion of sensitive datasets (HR, financial data)

Document/Row-Level (record)

• What it controls: Access to specific documents or rows
• Actions: read, write
• Scope: Query and modify data within datasets
• Use case: Read/write access to application logs, metrics, events

Field/Column-Level (field)

• What it controls: Visibility of specific fields or columns
• Scope: Redact sensitive fields (SSN, credit cards, emails)
• Configuration: Via Fields section in record permissions
• Use case: Compliance with data privacy regulations (GDPR, CCPA)

Metadata-Level

• What it controls: Access to schemas, mappings, and metadata
• Actions: read
• Scope: View database structure and field information
• Use case: Allow schema discovery without data access

---

Resource Types

Universal resource types work across all data systems:

Resource Type	SQL	NoSQL	Logs/Metrics	Monitoring & Alerts
metadata	INFORMATION_SCHEMA	Database metadata	Index mappings	N/A
dataset	Table	Collection	Index	N/A
record	Row	Document	Event/Data Point	N/A
field	Column	Field	Field/Label	N/A
notifications	N/A	N/A	N/A	Monitors & Channels

Actions by Resource Type

Resource Type	Actions	What It Controls
metadata	read	View schemas, mappings, list datasets
dataset	create, delete	Create/delete tables/indices, modify schemas
record	read, write	Query/insert/update/delete data
field	N/A	Controlled via Fields in record permissions
notifications	See below	Monitors and channels with resource-based access control

Notification Permissions

Notifications use a resource-based permission model where each monitor and channel has a unique ID:

Resource	Actions	What It Controls
Monitor	read, write, delete, execute	View, create/update, delete, run monitors
Channel	read, write, delete	View, create/update, delete channels
Config	write	Bulk import/export configurations

---

Default Permissions

Standard User Access

All users within an account can:

Operation	Applies To	Description
Query sources	Access connections	Query connected Elasticsearch, Snowflake, etc.
Query	Datasets	Search datasets
Execute SQL/Query DSL	All sources	Run queries via any interface
Browse schemas	Metadata	Explore data structure and metadata (requires metadata read permission)
Rotate own keys	User account	Manage own API credentials

Important: Access to these operations depends on the user's assigned roles. Users with no roles have no access (deny-by-default).

Admin-Only Operations

Only admins (users with admin roles) can:

• Create and delete users (humans or agents)
• Create and delete roles
• Manage connections to external sources
• View all users and roles
• Delete accounts

Root User

• Created automatically when an account is created
• Has unrestricted access to all resources and operations
• Similar to AWS account root user
• Cannot be deleted

---

Permission Examples

Read-Only Analyst

Version: 2025-01-01
Permissions:
  - ResourceType: record
    Actions: [read]
    Resources: ["*"]
    Fields:
      Mask:
        email: redact
        ssn: remove
      Deny:
        - password
        - api_key

Read-Write Application Service

Version: 2025-01-01
Permissions:
  - ResourceType: record
    Actions: [read, write]
    Resources:
      - logs-app-*
      - events-app-*

Data Engineer (Full Access)

Version: 2025-01-01
Permissions:
  - ResourceType: dataset
    Actions: [create, delete]
    Resources: ["*"]
  
  - ResourceType: record
    Actions: [read, write]
    Resources: ["*"]

Metadata Reader

Version: 2025-01-01
Permissions:
  - ResourceType: metadata
    Actions: [read]
    Resources: ["*"]

Team Alert Manager

Version: 2025-01-01
Notifications:
  Monitor:
    - Actions: [read, write, delete, execute]
      Resources: ["team-monitor-*"]  # Full access to team monitors
    - Actions: [read, execute]
      Resources: ["shared-monitor-*"]  # Read/execute shared monitors
  Channel:
    - Actions: [read, write, delete]
      Resources: ["team-channel-*"]  # Full access to team channels
    - Actions: [read]
      Resources: ["shared-channel-*"]  # Read-only shared channels
Permissions:
  - ResourceType: record
    Actions: [read]
    Resources: ["logs-*", "metrics-*"]  # Read data for monitor queries

User-Isolated Monitoring

Version: 2025-01-01
# Each user gets their own namespace
Notifications:
  Monitor:
    - Actions: [read, write, delete, execute]
      Resources: ["user123-monitor-*"]  # Only user123's monitors
  Channel:
    - Actions: [read, write, delete]
      Resources: ["user123-channel-*"]  # Only user123's channels

Alert Viewer (Read-Only)

Version: 2025-01-01
Notifications:
  Monitor:
    - Actions: [read]
      Resources: ["*"]  # Can view all monitors
  Channel:
    - Actions: [read]
      Resources: ["*"]  # Can view all channels

---

Security Best Practices

Data Protection

• All data is encrypted in transit (HTTPS required)
• API credentials are securely generated
• Authentication credentials expire automatically for security

Access Management

• Use separate users for different applications/environments
• Implement regular credential rotation
• Monitor authentication logs for suspicious activity
• Remove unused user accounts promptly
• Assign minimal necessary permissions (principle of least privilege)
• Use roles to group permissions, assign roles to users

---

Troubleshooting Access Issues

Common Authentication Errors

Error	Cause	Solution
401 Unauthorized	Invalid or expired credentials	Check access key/secret key or rotate keys
403 Forbidden	Insufficient permissions	Verify user has appropriate roles assigned
Invalid timestamp	Request timestamp too old/new	Ensure system clock is synchronized
Invalid signature	Malformed authorization header	Verify your credentials and authentication setup

Permission Errors

Error	Cause	Solution
User has no roles	User not assigned any roles	Assign at least one role to the user
Role not found	Role doesn't exist in account	Create the role first, then assign to user
Insufficient permissions for operation	User's roles don't grant required access	Update role permissions or assign additional roles
Access denied to resource	Resource pattern doesn't match	Check role's Resources patterns (wildcards supported)

---

API Reference

For detailed user and role management operations, see:

• User & Role Management
• Authentication
• Client SDKs