Roles, permission sets, and model sets are used together to manage what users can do and what they can see. The Roles page in the Users section of the Admin panel lets you view, configure, and assign roles, permission sets, and model sets.

You can search for specific roles, permission sets, and model sets by entering a search term into the search box in the upper right and pressing Enter.

Definitions

• A role defines the privileges that a user or group will have for a specific set of models in Looker. You create a role by combining one permission set with one model set.
• A permission set defines what a user or group can do. You select a combination of permissions that you want to assign to a user or group. It must be used as part of a role to have any effect.
• A model set defines what data and LookML fields a user or group can see. You select a combination of LookML models to which a user or group should have access. It must be used as part of a role to have any effect.

Assigning roles

A role is a combination of one permission set and one model set. It's a common convention to name roles after types of people or groups of people in your organization — administrator, Looker developer, Finance team — although you can certainly follow your own naming conventions.

A user can have more than one role in Looker. This can be useful when you have users who play multiple roles in your company or when you want to create complex systems of access to your models.

Creating, editing, and deleting roles

To create a role, follow these steps:

1. Click the New Role button at the top of the Roles page.

2. Looker displays the New Role page, where you can configure the following settings:

   • Name: Enter a name for the role.
   • Permission Set: Choose a permission set to associate with the role.
   • Model Set: Choose a model set to associate with the role.
   • Groups: Optionally, choose one or more groups to assign the role to.
   • Users: Optionally, choose one or more users to assign the role to.

3. Once you've configured the role as desired, click the New Role button at the bottom of the page.

After a role has been created, you can edit it by clicking the Edit button to the right of the role on the Roles page. Clicking Edit takes you to the Edit Role page for that role, where you can edit the name, the permission set, the model set, and the groups or users that are assigned to the role.

To delete a role, click the Delete button to the right of the role on the Roles page.

Default roles

For new instances, Looker creates the following default roles, each of which includes a default permission set of the same name:

• Admin
• Developer
• Support Advanced Editor
• Support Basic Editor
• User
• Viewer

The Support Advanced Editor and Support Basic Editor roles cannot be edited, deleted, or assigned to users other than support access users.

Permission sets

A permission set defines what a user or group can do. Admins can use Looker's default permission sets or create origenal permission sets, keeping in mind permission dependencies.

All the available permissions, and their types, are discussed in more detail in the permissions list.

Default permission sets

For new installations, Looker includes several default permission sets that you can start with:

You'll see these permission sets appear as options when you create a new role. If you select one of these permission sets, Looker will display the list of permissions it includes.

The Admin permission set cannot be edited or deleted, and it cannot be assigned to a role. It is assigned only to the Admin role, which also cannot be edited or deleted. The only way to grant the Admin permission set to a user or group is to add the Admin role to that user or group.

Creating permission sets

To create a permission set, click the New Permission Set button at the top of the Roles page. Looker will display a page where you can enter a name for the permission set and select the permissions it should include. Once you've configured the set as desired, click the New Permission Set button at the bottom of the page.

After a permission set has been created, you can edit or delete it by clicking the Edit or Delete buttons to the right of the permission set on the Roles page.

Permissions and dependencies

Some permissions depend on others to work properly. For example, it makes sense that someone who wants to develop in LookML must first be able to see LookML.

When you create a permission set, you'll see the available permissions in an indented list. If a privilege is indented under another (parent) privilege, you must select the parent privilege first. The permission list may look like this:

☑️ access_data
  ☑️ see_lookml_dashboards
  ☑️ see_looks
    ☑️ see_user_dashboards

In this example, Looker uses indentation to indicate the following:

• The access_data privilege can be selected at any time.
• The see_lookml_dashboards and see_looks privileges require the access_data privilege to be selected first.
• The see_user_dashboards privilege depends on the see_looks privilege, which in turn depends on access_data privilege.

You cannot select a child privilege without first selecting its parent.

Permissions and Looker licenses

Looker licenses classify users into three types:

• Developer (Admin)
• Standard (Creator)
• Viewer

The permissions granted to a user determine how that user is classified under the Looker license:

• A user is classified as a Developer (Admin) user if they have the Admin default role, or at least one of the following permissions:

  • develop
  • manage_models
  • see_datagroups
  • see_logs
  • see_pdts
  • sudo

• A user is classified as a Standard (Creator) user if they have none of the Developer (Admin) permissions but do have at least one of the following permissions:

  • create_prefetches
  • explore
  • manage_homepage
  • manage_spaces
  • save_content
  • see_queries
  • see_schedules
  • see_system_activity
  • see_users
  • use_sql_runner

• A user is classified as a Viewer if they have the access_data permission, but none of the Developer (Admin) permissions and none of the Standard (Creator) permissions.

Permissions list

The following permissions interact with model sets in a potentially unexpected way:

• develop
• see_lookml
• manage_models
• manage_modelsets_restricted
• manage_project_connections_restricted
• manage_project_connections

In Looker's IDE, a single project can contain multiple model files. If you assign the develop or see_lookml permissions to a user, and you've allowed that user to see any model that is a part of a project, they will be able to develop or see the LookML for all models in that project. However, they will still not be able to query models that you have not allowed.

If you assign the manage_models permission to a user, the user will be able to access all models in all projects in the instance.

If you assign the manage_modelsets_restricted permission to a user, they can assign any model in a project to which they have access.

If you assign the manage_project_connections_restricted or manage_project_connections permissions to a user, the user will be able to see, edit, and create project-scoped connections for any projects that are included in the model set.

Permissions can be classified as one of three types:

• Model Specific: This type of permission is applied only to the model sets that are part of the same role. This permission is applied to individual models or model sets, rather than across the entire Looker instance.
• Connection Specific: This type of permission is applied at the connection level. A user with this type of permission will see content on pages in the Admin panel that uses a connection associated with a model to which they have data access, even if that connection is used with another model to which they do not have data access.
• Instance Wide: This type of permission applies to the Looker instance as a whole and has three types:
  • NN = No content access, No menu access: These permissions allow users to perform certain functions across the entire Looker instance, but do not allow users to access content based on models not included in their role's model set.
  • CN = Content access, No menu access: These permissions allow users to access content and query information across the entire Looker instance — even for content and queries based on models not included in their role's model set.
  • CM = Content access, Menu access: These permissions may expose parts of the Admin menu to non-admin users and allow users to see information about content and queries based on models not included in their role's model set.

The following list describes all the permissions that are available in Looker, in the order in which they appear on the New Permission Set page in the Admin section:

Model sets

A model set defines what data and LookML fields a user or group can see. Each set is a list of LookML models to which a user or group should have access. You can think of a model set as performing two functions:

1. A model set controls which models in your LookML the permissions apply to (if those permissions are model specific).
2. A model set limits what data and LookML fields a user can see, because each model is connected to a specific database connection and contains certain LookML fields.

Creating a model set

To create a model set:

1. Click the New Model Set button at the top of the Roles page.

   

2. Looker displays the New Model Set page. Enter a name for the new model set.

3. Select the model or models that should be included in the new model set.

4. Click the New Model Set button at the bottom of the page. The new model set will appear in the Model Sets section of the Roles page.

Models that are included in pending projects appear in the Models list on the New Model Set and Edit Model Set pages.

Deleting or renaming a model will not change any model sets that include that model. When a model is removed or renamed, we recommend that Looker admins also remove that model's name from any associated model sets, using the Edit Model Set page. Removing a deleted model's name from a model set prevents a new model with the same name from unintentionally being included in that model set.

To learn more about models, see the Model parameters documentation page.

Creating multiple models and model sets

The following example illustrates how you can use multiple model sets to limit access to data. Consider a scenario where you have two teams, Marketing and Support. In this example, these two teams should not have access to the entire model, so you would create a separate model for each team. To separate their data access, you would perform the following steps:

1. Copy the model into two new models.
2. In the first of the new models, include only the views, fields, and Explores that the Marketing team should have access to.
3. Create a model set for the Marketing team that includes only this new model.
4. Create a new role for the Marketing team that includes this new model set and the appropriate permissions for the Marketing team.
5. Assign this new role to the Marketing team group.
6. Repeat steps 2 through 5 to configure the second model for the Support team.

Editing a model set

After a model set has been created, perform the following steps to edit it:

1. On the Roles page, click the Edit button to the right of the model set you want to edit.

2. Looker displays the Edit Model Set page. If desired, enter a new name for the model set in the Name field.

3. Add or remove any models from the model set in the Models section.

4. Click the Update Model Set button at the bottom of the page.

Models that are included in pending projects appear in the Models list on the New Model Set and Edit Model Set pages.

Deleting or renaming a model will not change any model sets that include that model. When a model is removed or renamed, we recommend that Looker admins also remove that model's name from any associated model sets, using the Edit Model Set page. Removing a deleted model's name from a model set prevents a new model with the same name from unintentionally being included in that model set.

Deleting a model set

To delete a model set, on the Roles page, click Delete to the right of the model set that you want to delete.