Setting up the IBM watsonx.data intelligence service

The watsonx.data intelligence service is provisioned automatically with a Trial plan when you sign up. To set up IBM watsonx.data intelligence for an organization, you start with upgrading the service and assigning IBM watsonx.data intelligence roles to users in your IBM Cloud account. Within IBM watsonx, an administrative user must create catalogs and the top-level categories for governance artifacts, and then add collaborators with the appropriate roles to each.

Upgrade the service.
Assign IBM watsonx.data intelligence roles.
Develop a plan for implementing data governance.
Delegate a user to manage Data Product Hub.

If you have a watsonx.data intelligence Trial plan, your capabilities are limited and some of these tasks are not applicable.

Upgrade the service to the appropriate plan

Required permissions: You must be the IBM Cloud account owner or administrator.

To upgrade IBM watsonx.data intelligence:

Determine the IBM watsonx.data intelligence service plan that you need. The features and functionality of IBM watsonx.data intelligence vary considerably across the service plans. See Watsonx.data intelligence service plans.
While logged in to IBM watsonx, from the main menu, click Services > Service instances.
Click the menu next to the IBM watsonx.data intelligence service and choose Upgrade service.
Choose the plan you want and click Upgrade.

Assign IBM watsonx.data intelligence roles to users or access groups

Required permissions: You must be the IBM Cloud account owner or administrator. Make sure that object storage is configured to allow users to create catalogs and projects. See Setting up IBM Cloud Object Storage for use with IBM watsonx.

After you add users to your IBM Cloud account, you must assign the appropriate IAM service and platform level roles to provide permissions for IBM watsonx.data intelligence. You have two choices for assigning roles:

Set up IAM access groups with a set of roles and add users as members of the access group. All members have the same roles which are updated when the group is updated. For instructions on creating access groups, see IBM Cloud docs: Setting up access groups.
Assign roles to individual users. To update roles, you must update each user independently.

Assigning access with access groups

For each access group, create an access policy by assigning service access and platform access roles.

From the Access tab for the group, click Assign access+.
For Service, choose IBM Cloud Pak for Data. The Service roles for IBM Cloud Pak for Data apply to IBM watsonx.data intelligence.
Next, assign a Service access role for the group. You can create a separate group for each role, for example:
- Assign the Manager role to an access group called Manager for users who are responsible for creating top-level categories and creating catalogs.
- Assign the Data Steward or Data Engineer role to access groups for users who are responsible for creating governance artifacts and curating data into catalogs.
- Assign the Data Scientist role to access groups for users who need to use catalog assets in projects.
Assign the Editor role for Platform access role to each group. The Editor role can perform all platform actions except for managing the account and assigning access policies.
Add and Assign the policy for the access group.
Add users to the group who require the access dictated by the group policy.

To add users to an access group, you choose a group in the IBM Cloud account and then add users. Follow these steps:

From IBM watsonx, choose Administration > Access (IAM) to open the Manage access and users page in your IBM Cloud account.
Select Access groups to see a list of available groups.
Select the access group that you want to populate with users and click Add users+ to show the list of users.
Checkmark the members for the access group and click Add to group.

If you do not have access groups yet, you can create them:

From IBM watsonx, choose Administration > Access (IAM) to open the Manage access and users page in your IBM Cloud account.
On the Access groups page, click Create+.
Provide a unique name of the group and optionally a description that describes the group's role.
Click Create and then add users to the group.

Assigning access to individual users

To assign IBM watsonx.data intelligence and Cloud Pak for Data roles to users who are already in your IBM Cloud account:

From IBM watsonx, choose Administration > Access (IAM) to open the Manage access and users page in your IBM Cloud account.
Select the user on the Users page.
Click the Access tab and then choose either Assign group+ or Assign access+.
For Assign group+, select one or more Access groups for the user, then Add and Assign them to the group.
To Assign access to an individual user, create an Access policy.
For Service, choose IBM Cloud Pak for Data. The Service roles for IBM Cloud Pak for Data apply to IBM watsonx.data intelligence.
Next, select one of the Service access roles:
- Assign the Manager role to users who are responsible for creating top-level categories, creating catalogs, and generating reports about IBM watsonx.data intelligence data.
- Assign the Data Steward or Data Engineer role to users who are responsible for creating governance artifacts and curating data into catalogs.
- Assign the Data Scientist role to users who need to use catalog assets in projects.
For Platform access:
- Assign the Editor role to each user with the other service access roles. The Editor role can perform all platform actions except for managing the account and assigning access policies.
Add and Assign the policy for the user.
To assign Data Product roles or Catalog roles, select the following IAM services, and roles based on their level in these tables:

Table 1. Data product roles
Data product roles	IAM Service	Role level	Role
Data Product Administrator Data Product Provider Data Product Consumer	watsonx.data intelligence	Platform	Viewer
Data Product Administrator	Cloud Pak for Data	Service	Data Product Administrator
Data Product Administrator	All IAM Account Management services	Platform	Viewer
Data Product Provider	Cloud Pak for Data	Service	Data Product Provider
Data Product Consumer	Cloud Pak for Data	Service	Data Product Consumer

Table 2. Catalog roles
Catalog roles	IAM Service	Role level	Role
Data Steward Data Engineer Data Scientist	watsonx.data intelligence	Platform	Editor
Data Steward	Cloud Pak for Data	Service	Cloud Pak Data Steward
Data Engineer	Cloud Pak for Data	Service	Cloud Pak Data Engineer
Data Scientist	Cloud Pak for Data	Service	Cloud Pak Data Scientist

Add to review each role in the Access summary.
After you have added each role for the user, select Assign in the Access summary.

For more information about the roles, see User roles and permissions for watsonx.data intelligence.

Develop a plan for implementing data governance

As a IBM watsonx.data intelligence administrator, you must perform other set up tasks for IBM watsonx.data intelligence, such as creating catalogs. You must understand the choices that you have and the implications of those choices before you start.

See Planning to implement data governance and Planning to set up IBM watsonx.data intelligence.

Delegate a user to manage Data Product Hub

Either the IBM Cloud account administrator or their delegate must initialize Data Product Hub.

The account administrator assigns the Manager role and other roles to delegate a user who can initialize Data Product Hub. The required roles are described in the following table:

IAM roles to delegate a user to manage Data Product Hub
Service	Role level	Role	Action
watsonx.data intelligence	Platform	Viewer	View watsonx.data intelligence service instance
Cloud Pak for Data	Service	Manager	Initialize Data Product Hub upon initial log in
All Account Management services	Platform	Administrator	To create a service ID and assign policies
Cloud Object Storage	Service	Manager	Configure a bucket for storing data contracts
Cloud Object Storage	Platform	Administrator	Configure a bucket for storing data contracts

After initializing Data Product Hub, the Manager performs the following next steps:

Creates a Cloud Object Storage bucket for storing data contracts. See Managing storage.
Adds the account administrator to the community with the Admin role. See Managing the Data Product Hub community.
Adds members to the community with appropriate roles. See Managing the Data Product Hub community.

Next steps

Finish the remaining steps for setting up the platform.