Understand RBAC and privileges

ThoughtSpot Role-Based Access Control (RBAC) helps an administrator manage roles and privileges that are assigned to users and groups in ThoughtSpot. A role is a collection of privileges. A privilege allows users to perform certain actions while preventing them from performing other actions. RBAC enhances the granularity of permissions that determine the access and capabilities of users and admins.

Roles can be assigned to groups. A group can have one or more roles assigned to it. When multiple roles are assigned to a group, the privileges available to users within that group are a union of the privileges in each role assigned to the group.

RBAC is disabled by default. To enable this feature, contact ThoughtSpot Support.

Once you enable RBAC it cannot be disabled.

Roles and privileges

A role is a collection of privileges. The role and its assigned privileges list the actions that can be performed, such as Can administer ThoughtSpot or Can upload user data. Roles can be high-level, like Super Admin, or specific based on your organization’s structure and requirements. Roles are configured and then assigned to groups. For more information about groups, see Understand groups and privileges.

ThoughtSpot delivers some standard roles to help you transition to RBAC. You can also create custom roles with custom privileges based on your organizational needs. The following are the standard roles delivered with ThoughtSpot.

The following table shows existing ThoughtSpot group privileges and the new more granular RBAC roles.

ThoughtSpot privilege ThoughtSpot RBAC roles

Can administer ThoughtSpot

Super Admin

Can manage Users

Can manage Groups

Can manage Roles

Can manage Orgs

Can manage Authentication

Can manage Application settings

Can view System activities

Can view Billing Information

Can manage data

Can create/edit connections

Can manage data models

Can manage custom calendars

Can upload user data

Previously, administrators were part of the administrator group, and data managers were part of the can manage data group. Members of the groups would have view and edit access to all data. In some organizations these functions are broken out in a more granular way between different users. Roles allow you to assign the specific roles and privileges required without including those that are not needed.

ThoughtSpot RBAC includes a Super Admin role that includes all of the privileges previously included in the Administrator group to help you migrate to RBAC. Users with this privilege can access all cluster data. This privilege should only be granted in exceptional circumstances.

RBAC roles

The following are descriptions of each of the RBAC roles.

Role Description

Super Admin

Can manage users and groups and has view and edit access to all data. Users with this privilege can access all cluster data. This privilege should only be granted in exceptional circumstances.

Can manage Users

Can create, view, update and delete users. This is an administrative privilege.

Can manage Groups

Can create, view, update and delete groups. This is an administrative privilege.

Can manage Roles

Can create, view, update and delete roles. This is an administrative privilege.

Can manage Orgs

Can create, view, update and delete Orgs in a multi-tenancy environment. This privilege is available only in Org enabled clusters. In an Org enabled cluster, this privilege is available only at the primary Org level and is not visible to any other Orgs.

Can manage Authentication

Can manage identity and access management.

Can manage Application settings

Can manage application settings.

Can view System activities

Can view all options under the System activities section.

Can view Billing Information

Can view all details under the Billing section.

Can create/edit connections

Can add new data connections or edit existing connections.

Can manage data models

Can create, edit, or delete data models.

Can manage custom calendars

Can create, edit, or delete custom calendars.

Can upload user data

Can upload user data.

Migrating to RBAC

Existing ThoughtSpot customers can easily migrate to RBAC using the roles delivered with ThoughtSpot 9.5.0.cl. ThoughtSpot delivers roles corresponding to each privilege previously available as part of the existing groups and groups are retained. This allows you to assign those privileges individually to groups using roles.

Create, edit, or delete a role

ThoughtSpot has customizable RBAC management for assigning privileges to roles. Before adding users to groups, you can create custom roles if necessary and assign them to groups. Each role includes a set of privileges for its users.

Create a role

To create a role, follow these steps:

  1. Navigate to the Admin Console by selecting the Admin tab from the top navigation bar.

  2. Select Roles from the side navigation bar that appears.

  3. Select the Create role button on the right side of the screen.

  4. In the Create role modal, enter the details for the new role:

    Role name

    Enter a unique name for the role.

    Role description

    Optionally, enter a description.

    Privileges

    Check the privileges you want to grant to the role.

  5. Click Review selection to continue.

  6. Review your selections, and click Save to create the new role.

Edit a role

To edit a role, follow these steps:

  1. Navigate to the Admin Console by selecting the Admin tab from the top navigation bar.

  2. Select Roles from the side navigation bar that appears.

  3. Click on a role to edit the role.

  4. In the Edit role modal, make your desired changes.

  5. Click Review selection to continue.

  6. Review your changes, and click Save.

Delete a role

To delete a role, follow these steps:

  1. Navigate to the Admin Console by selecting the Admin tab from the top navigation bar.

  2. Select Roles from the side navigation bar that appears.

  3. Select the role you plan to delete by clicking the box next to the role name. If you don’t immediately see the name of the group, try searching for it.

  4. Select Delete.

Assign roles to groups

Once you have created roles, you can assign them to groups to manage privileges for your users. For more information about assigning roles to groups, see Understand groups and privileges Create, edit, or delete a group.


Was this page helpful?