Superset Roles
You set up superset roles by grouping view and data rules into named profiles. Then you assign those profiles to users to control what dashboards and tables they read. Most teams start with the built-in profiles and add custom rules per data source. When teams grant broad roles to save time, users gain reach into every connected database. How superset roles work under the hood The app builds its rule model on a web framework that checks every page view. Each role holds a list of small permiss
Lambda Execution Roles: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up superset roles by grouping view and data rules into named profiles. Then you assign those profiles to users to control what dashboards and tables they read. Most teams start with the built-in profiles and add custom rules per data source. When teams grant broad roles to save time, users gain reach into every connected database.
How superset roles work under the hood
The app builds its rule model on a web framework that checks every page view. Each role holds a list of small permissions that pair an action with a resource. An action might let a user read a chart or edit a data source. A resource points to a specific dashboard, table, or menu item inside the app.
Built-in profiles cover common jobs for admins, power users, and basic chart readers. Admins can change app settings, manage users, and view every data source on the system. Power users can build charts and write custom SQL queries if their settings allow it. Basic readers start with no data access and need custom roles for each specific dataset.
Teams combine a base role with extra dataset roles to keep permissions tight. A user might get the basic reader profile plus one role for finance tables. The app merges the rules from both roles when that user logs in. If any assigned role permits the view, the app loads the chart for the user.
What native roles solve and where gaps remain
Native roles do a good job of hiding menus and locking down saved dashboards. They help teams split chart builders from regular readers across different business units. Row-level filters can also append a filter clause to queries on specific mapped tables. This setup stops casual users from clicking into tables they do not need for work.
Still, the app still talks to each backing database through a shared service account. Once a role grants access to the SQL editor, the user runs queries through that account. Native UI rules decide who opens the editor, not what individual statements do in flight. A user with query rights can bypass chart filters and query raw tables directly.
Lambda Execution Roles: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Database logs also show the shared app account instead of the person who wrote the query. Security teams struggle to trace a slow or risky query back to a single human user. Also, native roles do not mask sensitive fields like emails, phone numbers, or card numbers in flight. If a table holds raw national IDs, anyone with read rights on that table gets them.
Best practices for managing permissions at scale
Start by giving new users the most restricted base role by default. Create separate roles for each business domain or data source instead of editing base profiles. Map these roles to groups in your identity provider so logins update rules on each sign-in. This setup stops permission drift when people change teams or leave the company.
Keep SQL editor rights away from standard dashboard roles used by large groups. Only grant direct query tools to small groups that need to build new datasets. Review role assignments every quarter to spot users who hold multiple overlapping data roles. Clear naming rules for custom roles also help admins see what each group can read.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Can one user hold multiple superset roles at the same time?
Yes, you can assign several roles to a single user account at once. The app adds all permissions together and grants the union of every assigned rule. If one role allows access to a table, the user can read that table.
Do superset roles stop users from seeing sensitive columns in SQL queries?
Native roles work mainly at the database, table, and dashboard level. If a user has SQL editor access to a database, they can query any column available to the shared database account. To rewrite emails or card numbers in results, you need column masking in the data path.
How should teams sync identity provider groups with app roles?
You can map identity groups to local roles during the login flow. When a user signs in, the app reads their group list and assigns matching roles. This keeps group rules in one central place and removes manual role edits.