User & Role Management

Control access for both human users and AI agents. Create users, define roles with fine-grained permissions, and enforce RBAC policies across your entire data stack.

Unified Governance: The same permission system controls access for:

Human analysts and developers
AI agents via programmatic API access
External tools and integrations

Security Model

Infino uses an RBAC security model with a simple YAML configuration that works across SQL, NoSQL, logs, metrics, and most data systems.

Key Concepts

User: Individual with credentials (human or AI agent). Users are assigned Roles.
Role: Reusable set of Permissions that define what resources can be accessed and what actions can be performed.
Deny-by-default: Users with no roles have no access. Access must be explicitly granted by assigning the user to a role.
Root User: When an account is created, a root user is automatically created with unrestricted access.

Create User

Create a new user with specified credentials and roles.

Endpoint: PUT /user/{username}

Request (YAML):

PUT /user/jane-analyst
Content-Type: application/yaml

Version: 2025-01-01
Password: SecureP@ssw0rd2024!
Roles:
  - data-analyst
  - report-viewer

Response:

{
  "status": "OK",
  "message": "'jane-analyst' created."
}

User Configuration:

Version - Schema version (required, use "2025-01-01")
Password - User's login password (required)
Roles - Array of role names assigned to this user

Important: Users do NOT contain a Permissions section. Permissions are defined on Roles only.

Get User

Retrieve user information.

Endpoint: GET /user/{username}

Request:

GET /user/jane-analyst

Response:

{
  "jane-analyst": {
    "Version": "2025-01-01",
    "Roles": ["data-analyst", "report-viewer"],
    "account_id": "123456789012"
  }
}

Note: Password is never returned in GET responses.

Update User

Update user password or roles.

Endpoint: PATCH /user/{username}

Update Password:

PATCH /user/jane-analyst
Content-Type: application/yaml

Version: 2025-01-01
Password: NewSecureP@ssw0rd2025!
Roles:
  - data-analyst
  - report-viewer

Update Roles:

PATCH /user/jane-analyst
Content-Type: application/yaml

Version: 2025-01-01
Roles:
  - senior-analyst
  - report-admin

Note: PATCH updates the user configuration. Only include fields you want to change.

Delete User

Remove a user from your account.

Endpoint: DELETE /user/{username}

Request:

DELETE /user/jane-analyst

Response:

{
  "status": "OK",
  "message": "'jane-analyst' deleted."
}

Create Role

Define a role with specific permissions.

Endpoint: PUT /role/{role_name}

Request (YAML):

PUT /role/data-analyst
Content-Type: application/yaml

Version: 2025-01-01
Permissions:
  - ResourceType: record
    Actions: [read]
    Resources: ["logs-*", "metrics-*"]
    
  - ResourceType: dataset
    Actions: [create]
    Resources: ["reports-*"]

Response:

{
  "status": "OK",
  "message": "'data-analyst' created."
}

Role Configuration:

Version - Schema version (required, use "2025-01-01")
Permissions - Array of permission entries for data access
- ResourceType - Type of resource: metadata, dataset, record, field
- Actions - Array of allowed actions (see Resource Types table below)
- Resources - Array of index/table patterns (e.g., ["logs-*"])
- Fields - Optional field-level security (see Field-Level Security section)
Notifications - Optional notification permissions (see Notification Permissions section)

Resource Types & Actions

Different resource types support different actions:

Data Resources

Resource Type	Actions	What It Controls
metadata	`read`	View schemas, mappings, list datasets
dataset	`create`, `delete`	Create/delete tables/indices, modify schemas
record	`read`, `write`	Query/insert/update/delete data
field	N/A	Controlled via `Fields` in record permissions

Universal Terminology: Works across SQL, NoSQL, logs, and metrics:

dataset = Table (SQL) = Collection (NoSQL) = Index (logs/metrics)
record = Row (SQL) = Document (NoSQL) = Event (logs) = Data Point (metrics)
field = Column (SQL) = Field (NoSQL/logs) = Label (metrics)

Notification Resources

Notifications use a resource-based permission model:

Resource	Actions	What It Controls
Monitor	`read`, `write`, `delete`, `execute`	View, create/update, delete, run monitors
Channel	`read`, `write`, `delete`	View, create/update, delete channels
Config	`write`	Bulk import/export configurations

Field-Level Security

Control access to specific fields (columns) within records:

YAML:

Version: 2025-01-01
Permissions:
  - ResourceType: record
    Actions: [read]
    Resources: ["users"]
    Fields:
      # Allow specific fields only
      Allow: ["id", "name", "email", "created_at"]
      
      # Mask sensitive fields (shown but obscured)
      Mask:
        email: redact      # user@example.com → u***@e***.com
        phone: remove      # Field completely removed from response
        ssn: nullify       # Field set to null
      
      # Block fields entirely
      Deny:
        - password
        - api_key
        - secret_*         # Wildcards supported

Masking Options

Option	Behavior	Example Input	Example Output
`redact`	Obscure with asterisks	`john@email.com`	`j*@e*.com`
`remove`	Remove field entirely	`{"phone": "555-1234"}`	`{}`
`nullify`	Set to null	`{"ssn": "123-45-6789"}`	`{"ssn": null}`

Note: Masking enforcement is currently supported for Infino datasets and Elasticsearch/OpenSearch sources only. WARNING: When accessing data through unsupported systems, Mask directives will be ignored and sensitive fields may be exposed in plain text. Use Deny for absolute field blocking across all systems.

Notification Permissions

Control access to monitors and alert channels using resource patterns:

Pattern-Based Access Control

Version: 2025-01-01
Notifications:
  Monitor:
    - Actions: [read, write, delete, execute]
      Resources: ["team-monitor-*"]  # Full control of team monitors
    - Actions: [read, execute]
      Resources: ["shared-monitor-*"]  # Read and execute shared monitors
  Channel:
    - Actions: [read, write, delete]
      Resources: ["team-channel-*"]  # Full control of team channels

Examples

Team-Based Isolation:

# DevOps Team Role
Notifications:
  Monitor:
    - Actions: [read, write, delete, execute]
      Resources: ["devops-monitor-*"]
  Channel:
    - Actions: [read, write, delete]
      Resources: ["devops-channel-*", "shared-channel-*"]

User-Based Isolation:

# Individual User Role
Notifications:
  Monitor:
    - Actions: [read, write, delete, execute]
      Resources: ["user123-monitor-*"]
  Channel:
    - Actions: [read, write, delete]
      Resources: ["user123-channel-*"]

Read-Only Access:

# Alert Viewer Role
Notifications:
  Monitor:
    - Actions: [read]
      Resources: ["*"]  # Can view all monitors
  Channel:
    - Actions: [read]
      Resources: ["*"]  # Can view all channels

Best Practices for Notification IDs

When creating monitors and channels, use meaningful ID prefixes that align with your permission model:

Team resources: team-monitor-<name>, team-channel-<name>
User resources: <username>-monitor-<name>, <username>-channel-<name>
Shared resources: shared-monitor-<name>, shared-channel-<name>
Auto-generated: If no ID is specified, a UUID is generated

Get Role

Retrieve role configuration and permissions.

Endpoint: GET /role/{role_name}

Request:

GET /role/data-analyst

Response:

{
  "data-analyst": {
    "Version": "2025-01-01",
    "Permissions": [{
      "ResourceType": "record",
      "Actions": ["read"],
      "Resources": ["logs-*", "metrics-*"]
    }]
  }
}

Delete Role

Remove a role from your account.

Endpoint: DELETE /role/{role_name}

Request:

DELETE /role/data-analyst

Response:

{
  "status": "OK",
  "message": "'data-analyst' deleted."
}

Complete Workflow Example

Here's how to create a user with specific permissions:

Step 1: Create a Role

PUT /role/data-analyst
Content-Type: application/yaml

Version: 2025-01-01
Permissions:
  - ResourceType: record
    Actions: [read]
    Resources: ["analytics-*", "reports-*"]
    
  - ResourceType: dataset
    Actions: [create]
    Resources: ["reports-*"]

Step 2: Create the User

PUT /user/jane-analyst
Content-Type: application/yaml

Version: 2025-01-01
Password: SecureAnalyst123!
Roles:
  - data-analyst

Now jane-analyst can:

Read data from analytics-* and reports-* datasets
Create new datasets matching reports-* pattern
Cannot access other data (deny-by-default)

Common Permission Patterns

Read-Only Analyst

Role:

Version: 2025-01-01
Permissions:
  - ResourceType: record
    Actions: [read]
    Resources: ["*"]
    Fields:
      Mask:
        email: redact
        ssn: remove
      Deny:
        - password
        - api_key
        - secret_*

User:

Version: 2025-01-01
Password: AnalystP@ss2024!
Roles: [analyst]

Application Service

Role:

Version: 2025-01-01
Permissions:
  - ResourceType: record
    Actions: [read, write]
    Resources:
      - logs-app-*
      - events-app-*
      - metrics-app-*

User:

Version: 2025-01-01
Password: AppServiceP@ss2024!
Roles: [app-service]

Data Engineer (Full Access)

Role:

Version: 2025-01-01
Permissions:
  - ResourceType: dataset
    Actions: [create, delete]
    Resources: ["*"]
  
  - ResourceType: record
    Actions: [read, write]
    Resources: ["*"]

User:

Version: 2025-01-01
Password: EngineerP@ss2024!
Roles: [data-engineer]

UI Management

The Govern section in the Infino UI provides a visual interface for managing users and roles (admin only).

Users Tab

View all users in your account
Create new users
Edit user passwords and role assignments
Delete individual users or bulk delete
Search and filter by role
View user statistics (total users, users with/without roles)

Roles Tab

View all custom roles
Create new roles with YAML configuration
View role details
Delete roles

API Reference

For detailed API specifications, see:

Security Model​

Key Concepts​

Create User​

Get User​

Update User​

Delete User​

Create Role​

Resource Types & Actions​

Data Resources​

Notification Resources​

Field-Level Security​

Masking Options​

Notification Permissions​

Pattern-Based Access Control​

Examples​

Best Practices for Notification IDs​

Get Role​

Delete Role​

Complete Workflow Example​

Step 1: Create a Role​

Step 2: Create the User​

Common Permission Patterns​

Read-Only Analyst​

Application Service​

Data Engineer (Full Access)​

UI Management​

Users Tab​

Roles Tab​

API Reference​

Security Model

Key Concepts

Create User

Get User

Update User

Delete User

Create Role

Resource Types & Actions

Data Resources

Notification Resources

Field-Level Security

Masking Options

Notification Permissions

Pattern-Based Access Control

Examples

Best Practices for Notification IDs

Get Role

Delete Role

Complete Workflow Example

Step 1: Create a Role

Step 2: Create the User

Common Permission Patterns

Read-Only Analyst

Application Service

Data Engineer (Full Access)

UI Management

Users Tab

Roles Tab

API Reference