Ctrlk
Go to website
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Access Control

Control who can sign in to Seemore, what they are allowed to change, and which of your accounts they can see.

Overview

Access control in Seemore is built from three pieces, each answering a different question:

Building block
Question it answers
Where it lives

Users

Who can sign in?

Settings → Access control → Users

Roles

What are they allowed to change?

The Role column on each user

Asset groups

Which of your accounts can they see?

Settings → Access control → Asset groups

Teams connect them: a team bundles people together, grants them one or more asset groups, and can carry a default domain view. In most organizations you set the asset groups up once, attach them to teams, and from then on manage access simply by adding people to the right team.

Required role to configure: varies by object — Admin or higher for users and teams, Owner for asset groups. Each page below states its own requirement.

How Access Is Resolved

Every request a user makes is limited to the accounts they are allowed to see. Seemore works that list out as follows:

  1. Owners see everything. An Owner always has access to every connected account, regardless of teams or asset groups.

  2. Everyone else gets the union of their grants:

    • accounts granted directly on their user, under Access in their user settings, plus

    • every account covered by the asset groups attached to any team they belong to.

  3. A single-account fallback keeps new members unblocked. If a user ends up with no grants at all and your workspace has exactly one Snowflake account connected, they see that account. As soon as they have any grant, the fallback no longer applies.

Roles and asset access are independent, and both must allow an action: an Editor can change automations, but only on the accounts they can see; a Viewer with access to every account still cannot change anything.

The same resolution applies everywhere, not just in the UI: a personal access token or a connected AI tool sees exactly what its owner sees. See API Access (MCP).

Adding or removing a grant takes effect right away — the user does not need to sign out. A change to their role, on the other hand, applies on their next sign-in.

Access Control vs. Domains

The two look similar in the UI but do very different things:

  • Asset groups control access. What they exclude, the user genuinely cannot see anywhere in Seemore.

  • Domains control focus. They are reusable filters a user chooses from the domain selector, applied on top of what that user can already see. Clearing the domain brings back everything they have access to.

Use asset groups when data must stay out of someone's reach, and domains when you simply want to cut down the noise.

Managing Access From Your Identity Provider

If you sign in through Okta with SCIM provisioning, you can drive both roles and team membership from your identity provider instead of maintaining them by hand in Seemore. See Identity Provider Sync.

UsersTeamsAsset GroupsIdentity Provider Sync
PreviousUser Roles
NextUsers

Last updated