Access in Kater works like a shared drive. You give people, groups or everyone a level on a folder, and everything inside inherits it. The same grants apply in the portal, in a local copy, in VS Code and to every agent.

How access works

• Grants go to people, groups or Everyone. Everyone means every member of the organisation.
• Folders inherit. A folder inherits its parent’s grants unless it is restricted. Only folders can be restricted.
• Files always inherit. A grant on a file can only add access.
• New organisations start readable. Everyone is Viewer, with execute, on the root, so every member can open and run what is outside connections/. Restrict a folder that holds sensitive data.
• Connections are open only to the people granted them. connections/ is restricted with no grants, so a member sees only the connections an admin granted to them or to a group they are in. Admins see every connection. The person who connects a warehouse is Manager, with execute, on its connection.
• Personal folders are private. connections/<connection>/users/<email>/ is restricted to its owner, as Manager with execute. It appears at the owner’s first sign-in, in each connection they can use.
• Creators manage what they make. A creator gets a Manager grant, which can be removed.
• Admins keep full access. Organisation admins can read, change, delete, execute and manage everything, Personal folders included. No grant removes it.
• Grants live beside content. They are never in a file. A local copy holds only what its owner can read.

Share a folder, workspace or app

People with access always lists Organisation admins, with full access and execute, permanent. Sharing a single file from Files uses a smaller dialog: Add a person, then Can view, Can edit or Can manage, and Stop sharing.

Grant a connection

A grant on a connection is Viewer, with execute, on connections/<connection>. It opens the shared layer and the shared workspaces in it, which are not restricted, to read and run. Personal folders in it stay private.

• To a person. On Admin › Users, select the person, then Add connection under Connections. Select the cross on a connection to take it away. A connection that a group gives shows the group’s name.
• To a group. Share connections/<connection> with the group as Viewer with Can execute. A role’s group, such as Viewers, can get a connection like any group.
• When you invite someone. Select their connections in the invitation. See Users and roles.

An organisation made before this change keeps what it had, and Kater adds no grants: grant each connection to the people and groups who need it.

Check access as a person

To see what one member can do, select them on Admin › Users, then Check access as this person. The page shows the content tree, with the member’s level on each item. Select a file or folder to see whether they can open it, change it and run its queries, and why: each grant that applies and the folder it is on, a restricted folder above it, and their role where the role lowers what a grant gives. For example, a Viewer with an Editor grant on modeling/ can open it and run its queries, but cannot change it, because a Viewer cannot change the shared layer. Checking access reads the grants. You do not act as the member.

When a member leaves or changes email

• A removed member’s grants go. Their folders do not move. The person you select to get their work becomes Manager, with execute, on each of their folders and on what they managed alone. With no one selected, their folders stop inheriting and only admins can open them. See Remove a member.
• A member added again gets their folders back at their first sign-in, when nobody else got them.
• A new email moves their folders. When a member’s email changes, Kater moves each users/<old email>/ folder to users/<new email>/, with its grants, in one change, and every file that names the old folder names the new one.

Browse every folder

Admin › Files & access shows the whole content tree. Folders marked Restricted stop inheriting, and items marked Has its own grants add access of their own. Select an item, then Manage access. Only access admins can browse every file.

From the CLI

kater admin access show connections/snowflake_prod_connection/workspaces/ad_reporting
kater admin access grant connections/snowflake_prod_connection/workspaces/ad_reporting --level viewer --group Marketing
kater admin access revoke connections/snowflake_prod_connection/workspaces/ad_reporting --user sam@example.com

Run kater admin access in your own terminal. Agents and the Files terminal refuse it.

In VS Code

The Kater Access view in the Explorer shows and changes access for the file in the active editor. For a folder, right-click it in the Explorer and select Kater: Manage Access…. See VS Code extension.

If something looks wrong

• A colleague cannot see a workspace. Select them on Admin › Users, then Check access as this person, or run kater admin access show PATH to see each grant and where it comes from. Look for a restricted folder above it.
• A colleague sees no data. Grant them a connection. A member sees only the connections granted to them or to a group they are in.
• People lost access after a change. A restricted folder stops inheriting. Add grants on it, or select Inherits access.
• An app cannot be shared. Its readers need access to every workspace it reads. See Share and export.