Custom roles

Cube comes with default roles that cover common use cases. However, if you need more customization, you can create custom roles with a fine-grained set of permissions tailored to your organization's specific needs.

Managing roles

In Cube Cloud, users are not assigned permissions directly. Instead, they are assigned roles that are associated with policies. Each policy define what actions they can perform and on what resources they can perform those actions. This approach makes it easier to manage permissions at scale.

Each role can be associated with one or more of the following policies:

Each policy can apply to all resources or specific resources. For example, a policy could apply to all deployments or only to a specific deployment.

Also, each policy can have all actions or only specific actions associated with it. For example, a policy could allow a user to view, create, or delete one or more deployments if it's associated with those specific actions.

See actions reference for a list of available actions.

Browsing roles

To see a list of custom roles, go to the Admin -> Custom Roles page in your Cube account:

Creating a role

To create a new role, click the Add Role button. Enter a name and an optional description for the role, then click Add Policy and select either Deployment or Global for this policy's scope.

Deployment policies apply to deployment-level functionality, such as the Playground and Data Model editor. Global policies apply to account-level functionality, such as Billing. Once the policy scope has been selected, you can restrict which actions this role can perform by selecting "Specific" and using the dropdown to select specific actions.

When you are finished, click Create to create the role.

Assigning roles to users

To assign custom roles to users:

1. Navigate to Admin → Users
2. Choose one of the following methods:
   • From the users table: Use the dropdown in the users table
   • From individual user page: Click on a user and assign roles from their profile page
3. You can assign multiple custom roles to a single user

Actions

Policies can have the following actions associated with them.

Global

Deployment

Report

ReportFolder

Agent

AgentSpace

Workbook