Roles, permission sets, and model sets are used together to manage what users can do, and what they can see.

Definitions

• A model set defines what data and LookML fields a user or group can see. You select a combination of LookML models to which a user or group should have access. It must be used as part of a role to have any effect.
• A permission set defines what a user or group can do. You select a combination of permissions that you want to assign to a user or group. It must be used as part of a role to have any effect.
• A role is a combination of one permission set and one model set, and is used to assign a certain set of privileges to a certain set of models for a user or group.

Model Sets

A model set defines what data and LookML fields a user or group can see. It is simply a list of LookML models to which a user or group should have access. You can think of a model set as performing two functions:

1. A model set controls which models in your LookML the permissions apply to (if those permissions are model specific).
2. A model set limits what data and LookML fields a user can see, because each model is connected to a specific database connection and contains certain LookML fields.

To create a model set, click the New Model Set button at the top of the Roles page. Looker will display a new page where you can enter a name for the model set and select the models that should be a part of it. Once you’ve configured the set as desired, click the New Model Set button that will be at the bottom of the page.

After a model set has been created, you can edit or delete it by clicking the Edit or Delete buttons to the right of the model set on the Roles page.

To learn more about models, see our model reference. You may also find this Community topic useful, as it explains in greater detail how multiple models can be used to control user data access.

Permission Sets

A permission set defines what a user or group can do. It is simply a list of permissions that you want a user or group to have. Permissions can be applied in one of two ways:

• Model Specific: This type of permission is only applied to the model sets (described above) that are a part of the same role.
• Instance Wide: This type of permission applies to your Looker instance as a whole and exposes parts of the Admin menu to non-admin users. Non-admin users will be able to access content and functionality across the entire Looker instance—even if they haven’t been granted access to the particular model that uses that content.

All the available permissions, and their types, are discussed in more detail below.

Default Permission Sets

Looker includes several default permission sets that you can start with:

• Developer
• User
• LookML dashboard user
• User who can’t view LookML

You’ll see these permission sets appear as options when you create a new role. If you select one of these permission sets, Looker will display the list of permissions it includes.

Looker also includes a special permission set, Admin. The Admin permission set cannot be edited or deleted, and cannot be assigned to a role. It is assigned only to the Admin role, which also cannot be edited or deleted. The only way to grant the Admin permission set to a group or user is to add the Admin role to that group or user.

Creating Permission Sets

To create a permission set, click the New Permission Set button at the top of the Roles page. Looker will display a new page where you can enter a name for the permission set and select the permissions that should be a part of it. Once you’ve configured the set as desired, click the New Permission Set button that will be at the bottom of the page.

After a permission set has been created, you can edit or delete it by clicking the Edit or Delete buttons to the right of the permission set on the Roles page.

Permissions and Dependencies

Some permissions depend on others to work properly. For example, it makes sense that someone who wants to develop in LookML must first be able to see LookML.

When you create a permission set you’ll see the available permissions in an indented list. If a privilege is indented under another (parent) privilege, you must select the parent privilege first. Consider this example:

In this case Looker uses indentation to indicate that:

• The access_data privilege can be selected at any time.
• The see_lookml_dashboards and see_looks privileges require the access_data privilege to be selected first.
• The see_user_dashboards privilege depends on the see_looks privilege, which in turn depends on access_data privilege.

You cannot select a child privilege without selecting its parent first, which ensures that the permissions are configured correctly.

Permissions List

The following list describes all of the permissions that are available in Looker:

The develop and see_lookml permissions interact with model sets in a potentially unexpected way. In Looker’s IDE, a single project can contain multiple model files. If you assign develop or see_lookml to a user, and you’ve allowed them to see any model that is a part of a project, they will be able to develop or see the LookML for all models in that project. However, they will still not be able to query models that you have not allowed.

Roles

As mentioned above, to make use of a model set or permission set you must combine them in a role.

A role is a combination of one permission set and one model set. The name of a role usually represents a type of person in your organization, such as an administrator, a developer, or a member of the finance department, though it doesn’t have to.

It’s important to note that users can have more than one role. This can be useful for users who play multiple roles in your company, or when you want to execute complex access models.

Adding users to multiple roles has important implications for how their permissions are applied. For example, if you allow someone to save_content (an instance-wide permission) in only one of their roles, they will be allowed to save content everywhere. In contrast, if you allow someone to access_data (a model-specific permission) in only one of their roles, they can only access the models that are a part of that role.

Multiple roles can also cause unexpected effects on dashboards. See the Managing Business User Features documentation page for information about dashboards and multiple roles.

To create a role, click the New Role button at the top of the Roles page. Looker will display a new page where you can enter a name for the role, choose a permission set, and choose a model set. You will also be able to assign the role to a set of groups or users. Once you’ve configured the role as desired click the New Role button that will be at the bottom of the page.

After a role has been created, you can edit it by clicking the Edit button to the right of the role on the Roles page. This will take you to that role’s page, where you can:

• rename the role
• assign or edit the permission set associated with that role
• assign a model set to the role
• assign the role to groups and users.

To delete a role, click the Delete button to the right of the role on the Roles page.