Roles,permission sets, andmodel sets are used together to manage whatusers can do and what they can see. TheRoles page in theUsers section of theAdmin panel lets you view, configure, and assign roles, permission sets, and model sets.

You can search for specific roles, permission sets, and model sets by entering a search term into the search box in the upper right and pressingEnter.

Definitions

• Arole defines the privileges that auser orgroup will have for a specific set ofmodels in Looker. You create a role by combining one permission set with one model set.
• Apermission set defines what auser orgroup can do. You select a combination of permissions that you want to assign to a user or group. It must be used as part of a role to have any effect.
• Amodel set defines what data and LookML fields auser orgroup can see. You select a combination of LookML models to which a user or group should have access. It must be used as part of a role to have any effect.

Managing roles

A role is a combination of one permission set and one model set. It's a common convention to name roles after types of people or groups of people in your organization — administrator, Looker developer, Finance team — although you can certainly follow your own naming conventions.

A user can have more than one role in Looker. This can be useful when you have users who play multiple roles in your company or when you want to create complex systems of access to your models.

Adding users to multiple roles can have important implications for how the users'permissions are applied. For example, if a user has themanage_models permission (an instance-wide permission) in only one of their roles, they will be able to manage any model. In contrast, if a user has theaccess_data permission (a model-specific permission) in only one of their roles, that user can access only the models that are specified in that role.

Multiple roles can also cause unexpected effects on dashboards. SeeManaging business user features for information about dashboards and multiple roles.

Creating, editing, and deleting roles

To create a role, follow these steps:

1. Click theNew Role button at the top of theRoles page.

2. Looker displays theNew Role page, where you can configure the following settings:

   • Name: Enter a name for the role.
   • Permission Set: Choose a permission set to associate with the role.
   • Model Set: Choose a model set to associate with the role.
   • Groups: Optionally, choose one or moregroups to assign the role to.
   • Users: Optionally, choose one or moreusers to assign the role to.

3. Once you've configured the role as intended, click theNew Role button at the bottom of the page.

After a role has been created, you can edit it by clicking theEdit button to the right of the role on theRoles page. ClickingEdit takes you to theEdit Role page for that role, where you can edit the name, the permission set, the model set, and the groups or users who are assigned to the role.

To delete a role, click theDelete button to the right of the role on theRoles page.

Default roles

For new instances, Looker creates the following default roles, each of which includes adefault permission set of the same name:

• Admin
• Admin via IAM
• Developer
• Gemini
• Looker CI Users
• Conversational Analytics Agent Manager
• Conversational Analytics User
• Support Advanced Editor
• Support Basic Editor
• Customer Engineer Advanced Editor
• User
• Viewer

The default roles in the following sections have conditions for use.

Admin via IAM

TheAdmin via IAM role is available only inLooker (Google Cloud core), and it can be managed only through the Google Cloud console. For more information, see theAuthentication and authorization with OAuth and IAM andAdmin Looker role versus the Admin via IAM Looker role documentation.

TheAdmin via IAM role uses theAdmin permission set.

TheLooker CI Users role is created automatically for Looker instances that have beenenabled for Continuous Integration. TheLooker CI Users role is applied to the Looker CI service accounts that can be viewed in theService Accounts tab of theUsers Admin page. Looker uses these CI service accounts to performCI runs on the instance.

TheLooker CI Users role has the following permissions that are required to perform CI runs:

• deploy: required for setting up the GitHub webhooks that are required for CI runs
• see_ci: required to view the results of CI runs, view the CISuites page, and run CI suites
• manage_ci: required to create CI suites, manage CI users, and configure the Git connection with Continuous Integration

Gemini

TheGemini role cannot be renamed or deleted and contains only thegemini_in_looker permission in its permission set. By default, this role's permission set applies to all models on the Looker instance. To restrict users to accessing Gemini in Looker features with specific models, remove those user accounts from theGemini role and create a new role that applies thegemini_in_looker permission on selected models. Make sure to remove those users from theGemini Default Users group.

Thegemini_in_looker permission that is included in this role enables users to perform the following tasks in the Looker instance with Gemini assistance:

• Write LookML — when they also have a Looker role that contains thedevelop permission for at least one model in a LookML project.
• Create custom Looker visualizations — when they also have a Looker role that contains thecan_override_vis_config permission.
• Query Looker Explore data in Looker Studio withConversational Analytics, even if the user hasn't been assignedexplore permissions in Looker, when they also have a Looker role that contains theaccess_data permission.

Additional permissions are required to use Conversational Analytics in Looker, which can be granted with either theConversational Analytics Agent Manager orConversational Analytics User role.

For more information about Gemini in Looker features, see theGemini in Looker overview.

Conversational Analytics Agent Manager

TheConversational Analytics Agent Manager role consists of theConversational Analytics Agent Manager permission set for all models that are on the Looker instance. Users with this role can create, edit, share, and delete Conversational Analytics data agents that use Looker Explores.

Conversational Analytics User

TheConversational Analytics User role consists of theConversational Analytics User permission set for all models on the Looker instance. Users with this role can chat with any Conversational Analytics data agent in Looker, as long as they have been grantedView access to the data agent.

Support Advanced Editor and Support Basic Editor

These roles won't appear on a Looker (original) instance if a Looker admin has disabled theTiered Support Access Labs feature. These roles won't appear on a Looker (Google Cloud core) instance if the instance usesprivate connections (private services access or Private Service Connect) networking orhybrid connections networking.

TheSupport Advanced Editor andSupport Basic Editor roles cannot be edited, deleted, or assigned to users other thansupport access users.

Assigning default roles to a user

To update an individual user's settings to assign a default role, follow these steps:

1. Navigate to theUsers page in theUsers section of theAdmin panel.
2. Select the user or group whose permissions you want to change.
3. From theRoles drop-down menu, select the role name.
4. SelectSave to retain these settings.

Permission sets

A permission set defines what auser orgroup can do. Admins can use Looker'sdefault permission sets orcreate original permission sets, keeping in mind permissiondependencies.

All the available permissions, and their types, are discussed in more detail in thepermissions list.

Default permission sets

For new installations, Looker includes several default permission sets that you can start with:

You'll see these permission sets appear as options when you create a new role. If you select one of these permission sets, Looker will display the list of permissions that it includes.

Creating permission sets

To create a permission set, click theNew Permission Set button at the top of theRoles page. Looker will display a page where you can enter a name for the permission set and select the permissions that it should include. Once you've configured the set as needed, click theNew Permission Set button at the bottom of the page.

After a permission set has been created, you can edit or delete it by clicking theEdit orDelete buttons to the right of the permission set on theRoles page.

Permissions and dependencies

Some permissions depend on others to work properly. For example, it makes sense that someone who wants to develop in LookML must first be able to see LookML.

When you create a permission set, you'll see the available permissions in an indented list. If a privilege is indented under another (parent) privilege, you must select the parent privilege first. The permission list may look like this:

☑️ access_data  ☑️ see_lookml_dashboards  ☑️ see_looks    ☑️ see_user_dashboards

In this example, Looker uses indentation to indicate the following:

• Theaccess_data privilege can be selected at any time.
• Thesee_lookml_dashboards andsee_looks privileges require theaccess_data privilege to be selected first.
• Thesee_user_dashboards privilege depends on thesee_looks privilege, which in turn depends onaccess_data privilege.

You cannot select a child privilege without first selecting its parent.

Permissions and Looker licenses

Looker licenses classify users into three types:

• Developer (Admin)
• Standard (Creator)
• Viewer

The permissions granted to a user determine how that user is classified under the Looker license:

• A user is classified as a Developer (Admin) user if they have the Admindefault role, or at least one of the following permissions:

  • develop
  • manage_models
  • see_datagroups
  • see_logs
  • see_pdts
  • sudo

• A user is classified as a Standard (Creator) user if they have none of the Developer (Admin) permissions but do have at least one of the following permissions:

  • create_prefetches
  • explore
  • manage_homepage
  • manage_spaces
  • save_content
  • see_queries
  • see_schedules
  • see_system_activity
  • see_users
  • use_sql_runner
  • save_agents
  • admin_agents

• A user is classified as a Viewer if they have theaccess_data permission, but none of the Developer (Admin) permissions and none of the Standard (Creator) permissions.

Permissions list

Permissions can be classified as one of three types:

• Model Specific: This type of permission is applied only to themodel sets that are part of the same role. This permission is applied to individual models or model sets, rather than across the entire Looker instance.
• Connection Specific: This type of permission is applied at theconnection level. A user with this type of permission will see content on pages in theAdmin panel that uses a connection associated with a model to which they have data access, even if that connection is used with another model to which they do not have data access.
• Instance Wide: This type of permission applies to the Looker instance as a whole and has three types:
  • NN =No content access, No menu access: These permissions allow users to perform certain functions across the entire Looker instance, but do not allow users to access content based on models not included in their role's model set.
  • CN =Content access, No menu access: These permissions allow users to access content and query information across the entire Looker instance — even for content and queries based on models not included in their role's model set.
  • CM =Content access, Menu access: These permissions may expose parts of theAdmin menu to non-admin users and allow users to see information about content and queries based on models not included in their role's model set.

The following list describes all the permissions that are available in Looker, in the order in which they appear on theNew Permission Set page in theAdmin section:

Things to know about permission sets

The following permissions interact with model sets in a potentially unexpected way:

• develop;see_lookml — In Looker's IDE, a single project can contain multiple model files. If you assign thedevelop orsee_lookml permissions to a user, and you've allowed that user to seeany model that is a part of a project, they will be able to develop or see the LookML forall models in that project. However, they will still not be able toquery models that you have not allowed.
• manage_models — If you assign themanage_models permission to a user, the user will be able to access all models in all projects in the instance.
• manage_modelsets_restricted — If you assign themanage_modelsets_restricted permission to a user, they can assign any model in a project to which they have access.
• manage_project_connections — If you assign themanage_project_connections_restricted ormanage_project_connections permissions to a user, the user will be able to see, edit, and create project-scoped connections for any projects that are included in the model set.

Model sets

A model set defines what data and LookML fields auser orgroup can see. Each set is a list of LookML models to which a user or group should have access. You can think of a model set as performing two functions:

1. A model set controls which models in your LookML the permissions apply to (if those permissions are model specific).
2. A model set limits what data and LookML fields a user can see, because each model is connected to a specific database connection and contains certain LookML fields.

Creating a model set

To create a model set:

1. Click theNew Model Set button at the top of theRoles page.

1. Looker displays theNew Model Set page. Enter a name for the new model set.

2. Select the model or models that should be included in the new model set.

3. Click theNew Model Set button at the bottom of the page. The new model set will appear in theModel Sets section of theRoles page.

Models that are included inpending projects appear in theModels list on theNew Model Set andEdit Model Set pages.

Deleting or renaming a model will not change any model sets that include that model. When a model is removed orrenamed, we recommend that Looker admins also remove that model's name from any associated model sets, using theEdit Model Set page. Removing a deleted model's name from a model set prevents a new model with the same name from unintentionally being included in that model set.

To learn more about models, see theModel parameters documentation page.

Creating multiple models and model sets

The following example illustrates how you can use multiple model sets to limit access to data. Consider a scenario where you have two teams, Marketing and Support. In this example, these two teams should not have access to the entire model, so you would create a separate model for each team. To separate their data access, you would perform the following steps:

1. Copy the model into two new models.
2. In the first of the new models, include only the views, fields, and Explores that the Marketing team should have access to.
3. Create a model set for the Marketing team that includes only this new model.
4. Create a new role for the Marketing team that includes this new model set and the appropriate permissions for the Marketing team.
5. Assign this new role to the Marketing team group.
6. Repeat steps 2 through 5 to configure the second model for the Support team.

Editing a model set

After a model set has been created, perform the following steps to edit it:

1. On theRoles page, click theEdit button to the right of the model set you want to edit.

2. Looker displays theEdit Model Set page. Optionally, enter a new name for the model set in theName field.

3. Add or remove any models from the model set in theModels section.

4. Click theUpdate Model Set button at the bottom of the page.

Models that are included inpending projects appear in theModels list on theNew Model Set andEdit Model Set pages.

Deleting or renaming a model will not change any model sets that include that model. When a model is removed orrenamed, we recommend that Looker admins also remove that model's name from any associated model sets, using theEdit Model Set page. Removing a deleted model's name from a model set prevents a new model with the same name from unintentionally being included in that model set.

Deleting a model set

To delete a model set, on theRoles page, clickDelete to the right of the model set that you want to delete.

Creating and assigning custom roles

A custom role combines a default or custompermission set and a default or custommodel set. Roles can only be created based on permission and model sets that already exist. If a permission set doesn't exist that represents everything that you want the user to be able to do or if a model set doesn't exist that contains all the models that you want the user to be able to do those actions on, you must create the permission set or model set, respectively.

Create a custom role that uses existing permission and model sets

To assign a custom role with an existing permission set and an existing model set, follow these steps:

1. Navigate to theRoles page in theUsers section of theAdmin panel.
2. SelectNew Role.
3. Enter a name for your new role. Often role names indicate something about what tasks the role allows the user to do.
4. Next toPermission Set, select the permission set that you want to use for this role. The set of permissions appears beside the selected permission set.
5. Next toModel Set, select the model set that you want to use for this role. The set of models appears beside the selected permission set. To apply the selected permission set to all models on the Looker instance, selectAll.
6. Optionally, underGroups orUsers, select the groups or users that you want to assign the custom role to. You can also add users and groups to the role later by updating the role settings or you can assign the role later from theUsers orGroups page in theAdmin panel.
7. ClickNew Role to save this custom role.

Create a custom role that uses new permission and model sets

To create a custom role using new permission and model sets, first navigate to theRoles page in theUsers section of theAdmin panel.

To create a new permission set, follow these steps:

1. SelectNew Permission Set.
2. Provide a label for your new permission set in theName field.
3. Select the permissions that you want and clickNew Permission Set.

To create a new model set, follow these steps:

1. From theRoles page, selectNew Model Set.
2. Enter a label for your new model set in theName field.
3. Select the models that you want to apply your role to.
4. SelectNew Model Set.

To create the custom role using the new permission and model sets, follow these steps:

1. On theRoles page, selectNew Role.
2. Enter a name for your new role. Often role names indicate something about what tasks the role allows the user to do.
3. Provide a label for your new role in theName field.
4. ForPermission Set, select the permission set that you just created.
5. ForModel Set, select the specific models that you would like to apply thegemini_in_looker permission to. You may need to create a model set that contains the appropriate models before you can assign a model set to your new custom role.
6. Optionally, underGroups orUsers, select the groups or users that you want to assign the custom role to. You can also add users and groups to the role later by updating the role settings or you can assign the role later from theUsers orGroups page in theAdmin panel.
7. ClickNew Role to save this custom role.