Role-based Access Control

Centralized control for agents and humans. Manage users, assign roles, and govern what data both AI agents and human users can access across your entire stack.

Access governance via Govern in the sidebar (admin only).

Govern Section Overview

The Govern page provides two tabs for managing security:

Users Tab

Manage user accounts for humans and AI agents:

• View users - List all users in your account with roles
• Create users - Add new users with YAML configuration (Version, Password, Roles)
• Edit users - Update passwords and role assignments
• Delete users - Remove individual users or bulk delete
• Search & filter - Find users by name or filter by role
• Statistics - Total users, users with roles, users without roles

Roles Tab

Define and manage custom roles:

• View roles - List all custom roles (OS built-ins hidden)
• Create roles - Define permissions with YAML configuration
• View role details - See simplified YAML and copy to clipboard
• Delete roles - Remove roles from your account

---

User Management

Add Users

1. Navigate to Govern → Users tab
2. Click Add User
3. Enter user details:
   • Username (required)
   • Password (required, strong password enforced)
   • Select one or more roles
   • Optional: Email and full name
4. Click Create User

YAML Format:

Version: 2025-01-01
Password: SecureP@ssw0rd2024!
Roles:
  - analyst
  - viewer

Edit Users

1. Click the edit icon (pencil) next to a user
2. Update password and/or role assignments
3. Current password required to change password
4. Click Save

Delete Users

• Single user: Click the trash icon next to a user
• Bulk delete: Select multiple users with checkboxes, click Delete N users

---

Role Management

Create Roles

1. Navigate to Govern → Roles tab
2. Click Create Role
3. Enter role name (e.g., "data-analyst")
4. Define permissions in YAML format
5. Click Create

Example Role:

Version: 2025-01-01
Permissions:
  - ResourceType: record
    Actions: [read]
    Resources: ["logs-*", "metrics-*"]
    Fields:
      Allow: ["timestamp", "message", "level"]
      Mask:
        user_email: redact

View Role Details

1. Click View next to a role
2. See simplified YAML configuration
3. Click Copy YAML to copy to clipboard

Delete Roles

1. Click Delete next to a role
2. Confirm deletion

Note: Deleting a role does not delete users assigned to that role, but those users will lose the permissions granted by that role.

---

Resource Types

Four universal resource types work across all data systems:

Resource Type	SQL	NoSQL	Logs/Metrics
metadata	INFORMATION_SCHEMA	Database metadata	Index mappings
dataset	Table	Collection	Index
record	Row	Document	Event/Data Point
field	Column	Field	Field/Label

Actions by Resource Type

Resource Type	Actions	What It Controls
metadata	read	View schemas, mappings, list datasets
dataset	create, delete	Create/delete tables/indices, modify schemas
record	read, write	Query/insert/update/delete data
field	N/A	Controlled via Fields in record permissions

---

Field-Level Security

Control access to specific fields (columns) within records:

Permissions:
  - ResourceType: record
    Actions: [read]
    Resources: ["users"]
    Fields:
      # Allow specific fields only
      Allow: ["id", "name", "email", "created_at"]
      
      # Mask sensitive fields
      Mask:
        email: redact      # user@example.com → u***@e***.com
        phone: remove      # Field removed from response
        ssn: nullify       # Field set to null
      
      # Block fields entirely
      Deny:
        - password
        - api_key
        - secret_*

Masking Options:

• redact - Obscure with asterisks
• remove - Remove field entirely
• nullify - Set to null

Note: Masking is currently supported for Infino datasets and Elasticsearch/OpenSearch sources only.

---

Agent Access Control

The same RBAC system controls:

• Human users: Analysts and developers
• AI agents: Programmatic access via API

Create agent users with descriptive names:

Version: 2025-01-01
Password: AgentSecret2024!
Roles:
  - query-agent
  - metadata-reader

---

Account Information

View account details via user profile dropdown:

• Account ID - Your unique account identifier
• Company Name - Organization name
• Account Limits - Storage, max datasets, max users, max tenants

---

API Credentials Management

Current API Keys

Your API credentials are used to authenticate all API requests.

Key Rotation

Click "Rotate API Keys" to generate new credentials. The system displays a confirmation dialog before proceeding.

Critical

Secret keys are only shown once after rotation and cannot be displayed again. Copy and store your new secret key immediately.

• New access key and secret key are generated immediately
• Previous keys are invalidated instantly
• Keys are immediately active upon rotation
• Old keys stop working as soon as new ones are generated

API Key Usage

Your API keys are used for:

• Direct API calls to Infino endpoints
• SDK authentication
• Integration with external applications
• Programmatic access to your data

tip

Alerts, notification channels, and cron monitors all authenticate with the exact same API keys you manage here. If you rotate keys for an automation user, update any SDKs or CI jobs that call /alert or /monitor right away.

---

Monitoring & Alerts

The Govern page now includes native monitoring so you can define notification channels, templates, and monitors without relying on the legacy OpenSearch plugin.

Notification Channels

1. Go to Govern → Monitoring.
2. Click Add Channel and choose the delivery type:
   • Webhook – sends JSON payloads to HTTPS endpoints.
   • Slack – posts to Slack incoming webhooks.
   • Email – uses SMTP accounts defined in YAML (Ethereal, SES, etc.).
3. Paste a YAML definition (all monitoring resources are configured via YAML):

type: notification_channel
name: oncall-webhook
channel_type: webhook
description: Pager channel for production monitors
webhook:
  url: https://hooks.example.com/alerts

Save the channel to generate a channel_id, which you can reference from monitors or SDK scripts.

Monitors

Monitors run queries (QueryDSL, SQL, PromQL, or Fino NL), evaluate trigger conditions, and execute actions. Example:

name: errors-monitor
type: monitor
monitor_type: native
enabled: true
schedule:
  period:
    interval: 5
    unit: MINUTES
query:
  type: querydsl
  datasets:
    - logs-prod-*
  body:
    size: 0
    query:
      match: { "log.level": "ERROR" }
triggers:
  - name: webhook-alert
    severity: 1
    condition:
      type: count_greater_than
      threshold: 0
    actions:
      - id: prod-webhook
        destination_id: <channel_id>
        subject_template:
          source: "Logs alert {{monitor.name}}"
          lang: mustache
        message_template:
          source: |
            {{results.hits.total.value}} errors detected.
          lang: mustache

Highlights:

• Structured predicates: count_*, numeric thresholds, and string predicates (contains, starts_with, ends_with, matches with regex, case-insensitive support).
• Multiple query engines: QueryDSL or SQL against datasets, PromQL for metrics, and Fino NL for AI insights.
• Cron schedules: Use schedule.cron (supports standard expressions plus aliases like @hourly). The distributed scheduler ensures only one gateway pod runs the cron job.
• Throttle support: Add throttle blocks on actions to suppress repeats.

Bulk Configuration

Use Apply Configuration in the UI or POST to /alerts/config with a YAML payload that includes top-level channels, templates, and monitors. The operation is idempotent—existing IDs are updated and new ones are created automatically.

Execute & Debug

• Use Execute Monitor to run immediately without waiting for the next interval/cron.
• Gateway logs show trigger evaluation results, throttling decisions, and action dispatch attempts (including webhook retries).
• SDK helpers (InfinoSDK.create_alert, create_monitor, execute_monitor, etc.) mirror the UI workflows for GitOps automation.

---

Danger Zone

Account Deletion

warning

Account deletion is permanent and irreversible. This action will:

• Delete all data, indexes, and configurations
• Remove all user access and API keys
• Cancel your account and all associated services

Click "Delete Account" to access account deletion. The system requires confirmation through a deletion modal before proceeding.

---

Governance Features

• Fine-grained RBAC: Index/table, document/row, field/column level
• Deny-by-default: Access must be explicitly granted
• Unified control: Same policies for humans and agents
• Audit logs: Track all user and agent activity
• Encryption: Data encrypted at rest and in transit
• AWS SigV4 authentication: Secure request signing

---

Troubleshooting Access Issues

Common Authentication Errors

Error	Cause	Solution
401 Unauthorized	Invalid or expired credentials	Check access key/secret key or rotate keys
403 Forbidden	Insufficient permissions	Verify user has appropriate roles assigned
Invalid timestamp	Request timestamp too old/new	Ensure system clock is synchronized
Invalid signature	Malformed authorization header	Verify request signing implementation

Permission Errors

Error	Cause	Solution
User has no roles	User not assigned any roles	Assign at least one role to the user
Role not found	Role doesn't exist	Create the role first, then assign to user
Insufficient permissions	User's roles don't grant required access	Update role permissions or assign additional roles

---

Access Your Settings

• Govern (admin) - User and role management
• User Profile Dropdown → "My Account" - Personal account settings
• API Keys - Manage programmatic access credentials