Users and roles

See what each role allows, invite people from the CLI, and connect single sign-on and SCIM provisioning.

Audience

Platform admins

Prerequisites

directory:manage to manage users and groups

Bring your team into Kater and give each person the right role. Add people one at a time on the Admin Console’s Users page, as Manage users shows. Invite many at once from the CLI, and connect your identity provider for single sign-on.

Roles and permissions

Kater signs people in through PropelAuth. Each person has one of three roles: Admin, Developer or Viewer. Kater sets the permissions of each role, the same in every organisation. Kater checks the permissions, never the role’s name. To change a person’s role, see Change a role.

Permission	What it allows	Admin	Developer	Viewer
`content:read`	Read content, the catalog, history and lists.	✓	✓	✓
`content:write`	Make, change and delete content outside the shared layer, and keep your own state, such as dashboard filters.	✓	✓	✓
`queries:execute`	Run a saved query and receive its results.	✓	✓	✓
`connections:query`	Run SQL that a person or an agent writes, and previews and samples of a connection.	✓	✓	✓
`models:write`	Change the shared layer: semantic models, source datasets, Explore definitions and promotions. Approve or deny a promotion request.	✓	✓
`settings:manage`	Organisation settings and logo, connections, dataset sync, onboarding, GitHub write-back and Slack.	✓
`directory:manage`	Users, groups, attributes and invitations.	✓
`access:administer`	Organisation admin. Full access to all content, Personal folders included, and grants everywhere.	✓
`audit:read`	The admin Dashboard, the object inventory, the promotions list and audit logs.	✓

A permission is a limit above access levels. A person needs the permission for an action and an access level that allows it on the file or folder. For example, a Viewer role with Editor access on a connection’s modeling/ folder still cannot change a semantic model, because only models:write changes the shared layer.

Permissions and access are separate

Permissions decide which actions a person can take. Access levels on folders decide which content they can open. See Files and access.

Invite people from the CLI

kater admin team invite invites people by email. Anyone already invited or already a member is skipped.

kater admin team invite sam@example.com lee@example.com --role developer --group Marketing
kater admin team invite --csv people.csv

Option	What it does	Example
`--role`	admin, developer or viewer. The default is viewer.	`--role developer`
`--group`	A group to add them to. Repeat it for more groups.	`--group Marketing`
`--csv`	A CSV file of `email,name,role,groups,attributes`. Separate groups with `;` and write attributes as `key=value;key=value`.	`--csv people.csv`

email,name,role,groups,attributes
sam@example.com,Sam Lee,viewer,Marketing;Leadership,department=Marketing

Manage members from the CLI

Command	What it does
`kater admin member list`	Each member’s email, role and name.
`kater admin member role EMAIL ROLE`	Change a member’s role. Their role’s group follows it.
`kater admin member remove EMAIL`	Remove a member. `--to EMAIL` gives their work to that member, and `--schedules transfer` moves their schedules to them.

kater admin member role sam@example.com developer
kater admin member remove sam@example.com --to lee@example.com --schedules transfer

Run kater admin member in your own terminal. Agents and the Files terminal refuse it.

Single sign-on

kater admin sso link makes a 7-day link your IT team uses to connect your identity provider. It prints the link and says whether SSO is already configured.

SCIM provisioning

kater admin scim request asks Kater to switch on SCIM provisioning for your organisation. It answers “Requested. Kater will switch SCIM on; then create its key in your organisation settings.”

The CLI’s kater init offers the same four choices in its “Invite your team” step: Invite people, Invite from a CSV file, Get an SSO setup link for your IT team, and Ask Kater to enable SCIM provisioning.