4. Security, Roles and Privilege Management

Momentum provides authentication, authorization and access control at very granular level. This section describes access control features of Impulse.

User Group

Users belong to one of the following groups:

1. Admin
2. Writer
3. Reader
4. ReaderWriter

The access level of the members of these groups are described in the following table:

Functionality	Admin	Reader	Writer	ReaderWriter
Data warehouse
Create	yes	no	yes	yes
Edit	yes	no	yes	yes
View details	yes	no	yes	yes
Add tables	yes	no	yes	yes
Load Data	yes	no	yes	yes
Query	yes	yes	yes	yes
Manage User	yes	no	no	no
Manage Roles	yes	no	no	owner DW only
Monitor Tasks	yes	no	yes	yes
SQL	yes	yes	yes	yes
API: Query	yes	yes	yes	yes
System Config	yes	no	no	no
System Services	yes	no	no	no

Permission Types

1. Entire warehouse: all tables within warehouse accessible
2. Table or selected group of tables: only the included tables are accessible

Default role: <USER>_OWNER and assigned by default to the user who creates a warehouse

Events, Permissions, and Roles

System automatically creates and delete roles when certain events are triggered. The following table outlines events and different roles that are created or deleted.

Events	Actions
User signs up	<USER>_OWNER role is auto created
Create a DW	1. RW permission <DW>_RW is created 2. <USER_OWNER> role is assigned
Delete DW	1. <DW>_RW permission is removed
Delete Table	1. <TABLE>_RW permission is removed