Permissions

Keel has six workspace roles. Owner is tenant-wide: an Owner in any workspace has Owner permissions in every workspace of the tenant. The other roles are per workspace. Every request is checked on the server; the web app only hides what you can't do.

Role matrix

Generated from the code (RolePermissions in the Identity domain):

Permission	What it covers	Owner	Admin	Steward	Modeler	Analyst	Viewer
ManageTenant	Manage tenant, SSO, retention, certification criteria	✓
ManageMembersAndApiKeys	Manage members, API keys, notification channels, Git connection	✓	✓
ManageSources	Manage sources and secrets	✓	✓
RunScans	Run scans, drift scans, DQ runs, lineage rebuilds	✓	✓	✓	✓
EditModels	Review proposals, edit branches, open change requests	✓	✓	✓	✓
ApproveChanges	Approve change requests, publish releases	✓	✓	✓	✓
Govern	Approve glossary terms, certify, policies, DQ rule decisions, serving endpoints	✓	✓	✓
QueryServing	Query serving endpoints, playground, assistant	✓	✓	✓	✓	✓
ReadCatalog	Read models, glossary, lineage, scorecards	✓	✓	✓	✓	✓	✓
ReadAudit	Read the audit log	✓	✓	✓
EditMigrations		✓	✓	✓	✓
ApproveMigrations		✓	✓	✓
ExecuteMigrations		✓	✓	✓

API key scope	Grants (inside the key's workspace)
serving:query	QueryServing, ReadCatalog — serving endpoints
mcp:use	QueryServing, ReadCatalog — required by the MCP server
export:read	ReadCatalog — export downloads
admin:*	Every Admin permission of the workspace (never tenant ownership)

Rules on top of the matrix

• A Modeler may approve change requests and publish releases, but not their own change request, and changes to certified metrics need an approval from someone with Govern.
• The last Owner of a tenant can't be removed or demoted.
• Invitations are accepted only by a signed-in person whose email matches the invitation.
• API keys carry scopes instead of a role (table above). admin:* means workspace administration, never tenant ownership. For access policies an API key is evaluated as an Analyst with no attributes.
• Reading the audit log is tenant-wide and needs ReadAudit at tenant level; changing retention and running verification needs ManageTenant.
• MCP needs an API key with mcp:use (a serving:query-only key gets 403) or a person's OIDC token.

Typical operations

Operation	Permission
Register, update, test, delete a source; rotate its secret	ManageSources
Start a scan or drift scan; run DQ rules; rebuild or import lineage; handle incidents	RunScans
Accept or reject proposals; edit branches and working copies; open change requests; create and link glossary terms	EditModels
Approve a change request; publish or roll back a release; auto-export settings	ApproveChanges
Approve or deprecate terms; certify or revoke; write access policies; accept DQ rule suggestions; manage serving endpoints	Govern
Query serving endpoints, the Playground's query:run, the assistant	QueryServing
Read models, the catalog, glossary, lineage, scorecards; compile queries; download exports	ReadCatalog
Members, invitations, API keys, notification channels, Git connection	ManageMembersAndApiKeys
Tenant settings, certification criteria, audit retention	ManageTenant