Levels of user access roles in IBM watsonx
Every user of IBM watsonx has multiple levels of roles with the corresponding permissions, or actions. The permissions determine what actions a user can perform on the platform or within a service. Some roles are set in IBM Cloud, and others are set in IBM watsonx.
The IBM Cloud account owner or administrator sets the Identity and Access (IAM) Platform and Service access roles in the IBM Cloud account. Workspace administrators set the collaborator roles for workspaces, for example, projects.
Familiarity with the IBM Cloud IAM feature, Access groups, Platform roles, and Service roles is required to configure user access for IBM watsonx. See IBM Cloud docs: IAM access for a description of IBM Cloud IAM Platform and Service roles.
This illustration shows the different levels of roles assigned to each user so that they can work in IBM watsonx.
The levels of roles are:
- IAM Platform access roles determine your permissions for the IBM Cloud account. At least the Viewer role is required to work with services.
- IAM Service access roles determine your permissions within services.
- Workspace collaborator roles determine what actions you have permission to perform within workspaces in IBM watsonx.
IAM Platform access roles
The IAM Platform access roles are assigned and managed in the IBM Cloud account.
IAM Platform access roles provide permissions to manage the IBM Cloud account and to access services within IBM watsonx. The Platform access roles are Viewer, Operator, Editor, and Administrator. The Platform roles are available to all services on IBM Cloud.
The Viewer role has minimal, view-only permissions. Users need at least Viewer role to see the services in IBM watsonx. A Viewer can:
- View, but not modify, available service instances and assets
- Associate services with projects
- Become collaborator in projects or catalogs
- Create projects, deployment spaces, and catalogs if assigned appropriate permissions for Cloud Object Storage
The Operator role has permissions to configure existing service instances.
The Editor role provides access to these actions:
- All Viewer role permissions
- Provision instances of services
- Update plans for service instances
The Administrator role provides the same permissions as the Owner role for the account. With Administrator role, you can:
- All Viewer, Operator, and Editor permissions
- Perform all management actions for services
- Add users to the IBM Cloud account and assign roles
- Perform administrative tasks in IBM watsonx
- Manage services for IBM watsonx
- Set up access groups
- Create custom service roles
To understand IAM Platform access roles, see IBM Cloud docs: What is IBM Cloud Identity and Access Management?.
IAM Service access roles
Service roles apply to individual services and define actions permitted within the service. IBM Cloud Object Storage has its own set of Service access roles. See Setting up IBM Cloud Object Storage for use with IBM watsonx.
The following table shows the permissions for Service access roles for IBM Cloud Pak for Data for categories, catalogs, projects and data products:
| Role | Categories | Catalogs | Data Products | Projects |
|---|---|---|---|---|
| Manager | Manage | Manage | Manage | Manage |
| CloudPak Data Steward | Access | Access | None | None |
| CloudPak Data Engineer | Access | Access | None | None |
| CloudPak Data Scientist | None | Access | None | None |
| Reporting Administrator | None | Access | None | None |
| CloudPak Data Quality Analyst | None | None | None | None |
| Data Product Provider | None | None | Access | None |
| Data Product Consumer | None | None | Access | None |
For a full list of permissions and associated actions with these roles, see User roles and permissions.
The following table shows the permissions for IAM Service access roles for All Identity and Access enabled services for categories and catalogs:
| Role | Categories | Catalogs |
|---|---|---|
| Manager | Manage | Manage |
| Writer | None | Manage |
| Reader | None | View |
Workspace collaborator roles
Your role in a specific workspace determines what actions you can perform in that workspace. Your IAM roles do not affect your role within a workspace. For example, you can be the Administrator of the Cloud account, but this does not automatically make you an administrator for a project or catalog. The Admin collaborator role for a project (or other workspace) must be explicitly assigned. Similarly, roles are specific to each project. You may have Admin role in a project, which gives you full control of the contents of that project, including managing collaborators and assets. But you can have the Viewer role in another project, which allows you to only view the contents of that project.
Most workspaces have these roles:
- Admin: Control assets, collaborators, and settings in the workspace.
- Editor: Control assets in the workspace.
- Viewer: View the workspace and its contents.
Categories have the Owner and Reviewer roles that have slightly different permissions than Admin and Viewer.
Each workspace has a different purpose and specific permissions and roles:
-
Projects for working with data. See Project collaborator roles and permissions.
-
Data products for sharing data. See Data products collaborator roles and permissions.
-
Catalogs for sharing assets across your organization. See Catalog collaborator roles and permissions.
-
Categories for organizing governance artifacts. See Category collaborator roles and permissions.