--- updatedAt: 2026-09-30T19:41:56.000Z agentTools: projectIndex: https://docs.getmontecarlo.com/llms.txt --- # Built-in Roles Monte Carlo provides several built-in roles that cover most common access patterns. The comparison table below provides high-level information about each role to help select between them. For detailed information on each role, including allowed and denied permissions, jump to the [Roles Detail](#roles-detail) section below. You can also click the role name in the table to go directly to the role's details. We **deny by default**, so only the explicitly listed allowed permissions will be granted for a role. ## Comparing Roles The roles are ordered by least to most restrictive.
Role Description
Account Owner Full access--able to do anything customers are allowed to do with their Monte Carlo account.

**Recommended for:** Those responsible for configuring and managing all aspects of the Monte Carlo account (including integrations, billing, security, etc.).

**Restrictions:** None.
Domains Manager Allows access to all data + AI workflow features as well as managing personal API keys, data products, and domain-related settings such as domains, domain groups/users, ingestion, and notifications.

**Recommended for:** Data/team/product leads who will assist in administration of domains and users.

**Restrictions:** Cannot edit most account settings except for domain-related settings. No billing or secret value access.
Editor Allows access to all data + AI workflow features, as well as managing personal API keys, their own data products, and ingestion, notifications, and AI agent settings.

**Recommended for:** Data engineers that manage pipelines and data as a part of their job duties.

**Restrictions:** Cannot edit most account settings except for ingestion, notifications, and AI agent settings. No billing or secret value access.
Monitor Editor Allows access to most data + AI workflow features, as well as managing personal API keys, their own data products, and notifications settings.

**Recommended for:** Those who will add metric and validation monitors to key tables and pipelines.

**Restrictions:** Monitor-focused settings only—no catalog editing, account management, or billing/secret value access.
Responder Allows read-only access to data + AI workflow features plus alert response actions. May also draft monitors.

**Recommended for:** Those who triage and respond to alerts but will not manage Monte Carlo configuration/settings.

**Restrictions:** Only able to respond to alerts. No changing account settings and no billing or secrets access.
Viewer Allows read-only access to data + AI workflow features. May also draft monitors.

**Recommended for:** Those who may benefit from understanding data + AI quality issues but who are not responsible for fixing them.

**Restrictions:** Mostly read only. No changing account settings, no billing access, and no access to secret values.
## Roles Detail In the Permission list for each role, **only the permissions specifically allowed (`✅`) or denied (`❌`) for the role are listed**. If a permission is not listed, a user with only that role would be denied. Note that a user's effective permissions are a combination of all the roles assigned to the authorization groups they are a member of. You can hover over the ✅ or ❌ icon to see which policy statement allows or denies the permission. You can use the Definition tab to see the complete role definition with all of its policy statements. Deprecated permissions are omitted from these lists. ### Account Owner Full access--able to do anything customers are allowed to do with their Monte Carlo account. **Restrictions:** None. **Recommended for:** Those responsible for configuring and managing all aspects of the Monte Carlo account (including integrations, billing, security, etc.). **Role name:** `mcd/owner` **Built-in authorization group:** Account Owners
Permission Description
✅ Agent Observability → Access Allow viewing the Agent Observability area, including the list of agents, their traces and spans, and the metrics and metadata describing them.
✅ Agent Observability → Content Allow viewing raw Agent Observability content. This includes conversation and trace prompts, completions, tool inputs and outputs, transcripts, and span attributes.
✅ AI Agents → Access Allow viewing AI agent features available to the account.
✅ AI Agents → Triage → Edit Allow running the Triage Agent to triage and update alerts.
✅ AI Agents → Troubleshooting → Access Allow running the Troubleshooting Agent on alerts and viewing its analyses.
✅ Alerts → Access Allow viewing alerts and their details.
✅ Alerts → Edit Allow editing alerts, including merging, splitting, and updating properties.
✅ Alerts → Update Status Allow updating alert status (e.g., acknowledging, resolving) and providing feedback on anomaly detections.
✅ Assets → Access Allow viewing the assets catalog and asset metadata.
✅ Assets → Edit Allow editing asset metadata in the catalog.
✅ Dashboard → Access Allow viewing dashboards.
✅ Dashboard → Edit Allow creating and editing all dashboards in the account.
✅ Dashboard → Edit Their Own Allow creating and editing only dashboards the current user created. Those with `dashboard/edit` permission can also edit these dashboards.
✅ Data Exports → Access Allow accessing and downloading data exports.
✅ Data Products → Access Allow viewing data products.
✅ Data Products → Edit Allow creating and editing all data products in the account.
✅ Data Products → Edit Their Own Allow creating and editing only data products the current user created. Those with `data-products/edit` permission can also edit these data products.
✅ GraphQL → Mutate Allow making modifications (executing mutations) via the GraphQL API. This is required for any writes. This is always asserted in addition to any more specific permissions.
✅ GraphQL → Query Allow reading data (executing queries) via the GraphQL API. This is required for baseline read-only access to the system, and is always asserted in addition to any more specific permissions.
✅ Lineage → Access Allow viewing lineage graphs and their metadata.
✅ Lineage → Edit Allow creating and editing lineage metadata (nodes, edges, etc.).
✅ MCP → Access Allow authenticating to MCP and using read-only MCP tools.
✅ MCP → Edit Allow authenticating to MCP and using tools that modify account data or configuration.
✅ Monitors → Aggregates Allow viewing monitor metrics and aggregate summaries without full monitor access. Used for dashboards and reporting.
✅ Monitors → Data Sampling → Access Allow accessing sampled data from tables. Required to view sample data in the UI.
✅ Monitors → Data Sampling → Download Allow downloading sampled data from tables.
✅ Monitors → Exceptions → Access Allow viewing monitor exception activity logs.
✅ Monitors → Exceptions → Edit Allow editing monitor exceptions, including updating attributes and adding comments.
✅ Monitors → Management → Tune Model Allow tuning the detection model of existing monitors (e.g., adjusting anomaly sensitivity/thresholds) without permission to create, edit, or delete monitors. Anyone with monitor edit access can already tune; grant this to extend tuning to roles that otherwise only respond to alerts.
✅ Monitors → Management → Agent Evaluation → Access Allow viewing agent evaluation monitors and their configurations.
✅ Monitors → Management → Agent Evaluation → Draft Allow creating and editing draft agent evaluation monitors.
✅ Monitors → Management → Agent Evaluation → Edit Allow creating, updating, and deleting agent evaluation monitors.
✅ Monitors → Management → Agent Metric → Access Allow viewing agent metric monitors and their configurations.
✅ Monitors → Management → Agent Metric → Draft Allow creating and editing draft agent metric monitors.
✅ Monitors → Management → Agent Metric → Edit Allow creating, updating, and deleting agent metric monitors.
✅ Monitors → Management → Agent Trajectory → Access Allow viewing agent trajectory monitors and their configurations.
✅ Monitors → Management → Agent Trajectory → Draft Allow creating and editing draft agent trajectory monitors.
✅ Monitors → Management → Agent Trajectory → Edit Allow creating, updating, and deleting agent trajectory monitors.
✅ Monitors → Management → Agent Validation → Access Allow viewing agent validation monitors and their configurations.
✅ Monitors → Management → Agent Validation → Draft Allow creating and editing draft agent validation monitors.
✅ Monitors → Management → Agent Validation → Edit Allow creating, updating, and deleting agent validation monitors.
✅ Monitors → Management → Comparison → Access Allow viewing comparison monitors and their configurations.
✅ Monitors → Management → Comparison → Draft Allow creating and editing draft comparison monitors.
✅ Monitors → Management → Comparison → Edit Allow creating, updating, and deleting comparison monitors.
✅ Monitors → Management → Custom Sql → Access Allow viewing custom SQL monitors and their configurations.
✅ Monitors → Management → Custom Sql → Draft Allow creating and editing draft custom SQL monitors.
✅ Monitors → Management → Custom Sql → Edit Allow creating, updating, and deleting custom SQL monitors.
✅ Monitors → Management → Job → Access Allow viewing job monitors and their configurations.
✅ Monitors → Management → Job → Draft Allow creating and editing draft job monitors.
✅ Monitors → Management → Job → Edit Allow creating, updating, and deleting job monitors.
✅ Monitors → Management → Json Schema → Access Allow viewing JSON schema monitors and their configurations.
✅ Monitors → Management → Json Schema → Draft Allow creating and editing draft JSON schema monitors.
✅ Monitors → Management → Json Schema → Edit Allow creating, updating, and deleting JSON schema monitors.
✅ Monitors → Management → Metric → Access Allow viewing metric monitors and their configurations.
✅ Monitors → Management → Metric → Draft Allow creating and editing draft metric monitors.
✅ Monitors → Management → Metric → Edit Allow creating, updating, and deleting metric monitors.
✅ Monitors → Management → Query Performance → Access Allow viewing query performance monitors and their configurations.
✅ Monitors → Management → Query Performance → Draft Allow creating and editing draft query performance monitors.
✅ Monitors → Management → Query Performance → Edit Allow creating, updating, and deleting query performance monitors.
✅ Monitors → Management → Table → Access Allow viewing table monitors and their configurations.
✅ Monitors → Management → Table → Draft Allow creating and editing draft table monitors before they are published.
✅ Monitors → Management → Table → Edit Allow creating, updating, and deleting table monitors.
✅ Monitors → Management → Validation → Access Allow viewing validation monitors and their configurations.
✅ Monitors → Management → Validation → Draft Allow creating and editing draft validation monitors.
✅ Monitors → Management → Validation → Edit Allow creating, updating, and deleting validation monitors.
✅ Performance → Access Allow accessing the performance dashboard and query analytics.
✅ Performance → Insights → Edit Allow acting on an insight, such as creating a ticket from it in a connected ticketing tool.
✅ Settings → Access Top-level permission for viewing account settings. This is used where there is not a more specific permission for a given setting.
✅ Settings → Edit Top-level permission for editing account settings. This is used where there is not a more specific permission for a given setting.
✅ Settings → List Iam Resources Allow listing IAM resource and permission definitions. Required for managing users, authorization groups, or roles, since these operations need to display available permissions.
✅ Settings → Set Account Name Allow changing the account display name.
✅ Settings → Set Required Monitor Fields Allow changing which monitor fields must be filled in when creating or editing a monitor in this account.
✅ Settings → Agent Conversation Logs → Access Allow exporting the account's Operations Agent conversation logs.
✅ Settings → Agents → Access Allow viewing agent details, logs, and reachability information.
✅ Settings → Agents → Edit Allow creating, updating, deleting, and managing data collection agents.
✅ Settings → AI Agents → Access Allow viewing AI agent settings.
✅ Settings → AI Agents → Edit Allow enabling, disabling, and configuring AI agents, including automated triage thresholds, usage limits, and per-domain overrides.
✅ Settings → Alert Actions → Edit Allow changing whether acting on an alert from a connected Slack or Microsoft Teams channel requires a matching Monte Carlo user with sufficient permissions.
✅ Settings → API → Access Allow accessing API settings and the API explorer.
✅ Settings → API → Edit Allow managing personal API tokens.
✅ Settings → API → Manage Tokens Allow managing account-level service tokens and integration tokens.
✅ Settings → API → Manage User Tokens Allow admins to list and revoke another user's personal API tokens.
✅ Settings → Authorization Groups → Access Allow viewing authorization groups and their members. Also required for user management, since group membership is displayed when managing users.
✅ Settings → Authorization Groups → Edit Allow creating, editing, and deleting authorization groups.
✅ Settings → Authorization Groups → Manage Domains Managers Allow managing members of the built-in Domains Managers authorization group.
✅ Settings → Authorization Groups → Manage Owners Allow managing members of the built-in Account Owners authorization group.
✅ Settings → Billing → Access Allow viewing billing information and invoices.
✅ Settings → Billing → Edit Allow modifying billing plan and contract settings.
✅ Settings → Deployments → Access Allow viewing deployment details.
✅ Settings → Deployments → Edit Allow creating, updating, and deleting deployments.
✅ Settings → Domains → Access Allow viewing domain settings.
✅ Settings → Domains → Edit Allow creating, editing, and deleting domains and related settings.
✅ Settings → Domains → List Allow listing available domains.
✅ Settings → Domains → View Detail Allow viewing detailed domain information and their assets.
✅ Settings → Ingestion → Access Allow viewing data ingestion settings and metrics.
✅ Settings → Ingestion → Edit Allow editing data ingestion settings.
✅ Settings → Ingestion → Manage Collection Allow managing data collection settings, including upgrades and collection preferences.
✅ Settings → Integrations → Access Allow viewing integrations and their configurations.
✅ Settings → Integrations → Edit Allow creating, editing, and deleting integrations.
✅ Settings → MCP Servers → Access Allow viewing custom MCP server connections and their configurations.
✅ Settings → MCP Servers → Edit Allow creating, editing, and deleting custom MCP server connections and their credentials.
✅ Settings → Network → Access Allow viewing network access control settings.
✅ Settings → Network → Edit Allow managing network access control settings.
✅ Settings → Notifications → Access Allow viewing notification settings, audiences, and channels.
✅ Settings → Notifications → Edit Allow creating, editing, and deleting notification settings, audiences, and channels.
✅ Settings → OAuth Clients → Access Allow viewing OAuth clients and their configurations.
✅ Settings → OAuth Clients → Edit Allow creating and managing agent OAuth clients.
✅ Settings → OAuth Clients → Manage User Clients Allow admins to list and revoke another user's OAuth clients.
✅ Settings → PII Filters → Edit Allow creating, editing, and deleting PII filters.
✅ Settings → PII Filters → List Allow listing PII filters.
✅ Settings → PII Filters → View Metrics Allow viewing PII filter detection metrics.
✅ Settings → Roles → Access Allow viewing account roles and their permission definitions. Also required for managing authorization groups, since role assignment requires listing available roles.
✅ Settings → Roles → Edit Allow creating, editing, and deleting custom account roles.
✅ Settings → Secrets → Access Allow viewing secrets (names/metadata only, not values). Use `settings/secrets/view-values` to view secret values.
✅ Settings → Secrets → Edit Allow creating, editing, and deleting secrets.
✅ Settings → Secrets → View Values Allow viewing secret values. This grants access to sensitive credential data.
✅ Settings → Session → Access Allow viewing session timeout settings.
✅ Settings → Session → Edit Allow managing session timeout settings.
✅ Settings → SSO → Access Allow viewing SSO configuration settings.
✅ Settings → SSO → Edit Allow configuring single sign-on (SSO) settings.
✅ Settings → User → Subscribe Weekly Digest Allow subscribing to or unsubscribing from the weekly digest email notification.
✅ Settings → Users → Access Allow viewing authentication and authorization settings.
✅ Settings → Users → Edit Allow managing users, authorization groups, SSO, and authorization provisioning (SCIM) settings.
✅ Settings → OAuth Clients → Personal OAuth Clients → Edit Allow creating and managing your own personal OAuth clients.
✅ Settings → OAuth Clients → Service OAuth Clients → Edit Allow creating and managing service-account OAuth clients.
✅ Users → Account Owners Allow viewing the list of Account Owners in the account.
✅ Users → List Allow listing users in the account for features like assignee selection and @mentions.
*If a permission is not listed here, it is denied for this role.* ```yaml iam-role: version: "2022-03-17" name: mcd/owner label: "Account Owner" description: Full access--able to do anything customers are allowed to do with their Monte Carlo account. restrictions_summary: None. recommended_for: Those responsible for configuring and managing all aspects of the Monte Carlo account (including integrations, billing, security, etc.). permissions: graphql/*: allow monitors/*: allow dashboard/*: allow data-products/*: allow data-exports/access: allow alerts/*: allow assets/*: allow lineage/*: allow mcp/*: allow ai-agents/*: allow agent-observability/access: allow agent-observability/*: allow performance/*: allow settings/*: allow users/*: allow ``` *** ### Domains Manager Allows access to all data + AI workflow features as well as managing personal API keys, data products, and domain-related settings such as domains, domain groups/users, ingestion, and notifications. **Restrictions:** Cannot edit most account settings except for domain-related settings. No billing or secret value access. **Recommended for:** Data/team/product leads who will assist in administration of domains and users. **Role name:** `mcd/domains-manager` **Built-in authorization group:** Domains Managers (All)
Permission Description
✅ Agent Observability → Access Allow viewing the Agent Observability area, including the list of agents, their traces and spans, and the metrics and metadata describing them.
✅ Agent Observability → Content Allow viewing raw Agent Observability content. This includes conversation and trace prompts, completions, tool inputs and outputs, transcripts, and span attributes.
✅ AI Agents → Access Allow viewing AI agent features available to the account.
✅ AI Agents → Triage → Edit Allow running the Triage Agent to triage and update alerts.
✅ AI Agents → Troubleshooting → Access Allow running the Troubleshooting Agent on alerts and viewing its analyses.
✅ Alerts → Access Allow viewing alerts and their details.
✅ Alerts → Edit Allow editing alerts, including merging, splitting, and updating properties.
✅ Alerts → Update Status Allow updating alert status (e.g., acknowledging, resolving) and providing feedback on anomaly detections.
✅ Assets → Access Allow viewing the assets catalog and asset metadata.
✅ Assets → Edit Allow editing asset metadata in the catalog.
✅ Dashboard → Access Allow viewing dashboards.
✅ Dashboard → Edit Allow creating and editing all dashboards in the account.
✅ Dashboard → Edit Their Own Allow creating and editing only dashboards the current user created. Those with `dashboard/edit` permission can also edit these dashboards.
✅ Data Exports → Access Allow accessing and downloading data exports.
✅ Data Products → Access Allow viewing data products.
✅ Data Products → Edit Allow creating and editing all data products in the account.
✅ Data Products → Edit Their Own Allow creating and editing only data products the current user created. Those with `data-products/edit` permission can also edit these data products.
✅ GraphQL → Mutate Allow making modifications (executing mutations) via the GraphQL API. This is required for any writes. This is always asserted in addition to any more specific permissions.
✅ GraphQL → Query Allow reading data (executing queries) via the GraphQL API. This is required for baseline read-only access to the system, and is always asserted in addition to any more specific permissions.
✅ Lineage → Access Allow viewing lineage graphs and their metadata.
✅ Lineage → Edit Allow creating and editing lineage metadata (nodes, edges, etc.).
✅ MCP → Access Allow authenticating to MCP and using read-only MCP tools.
✅ MCP → Edit Allow authenticating to MCP and using tools that modify account data or configuration.
✅ Monitors → Aggregates Allow viewing monitor metrics and aggregate summaries without full monitor access. Used for dashboards and reporting.
✅ Monitors → Data Sampling → Access Allow accessing sampled data from tables. Required to view sample data in the UI.
✅ Monitors → Data Sampling → Download Allow downloading sampled data from tables.
✅ Monitors → Exceptions → Access Allow viewing monitor exception activity logs.
✅ Monitors → Exceptions → Edit Allow editing monitor exceptions, including updating attributes and adding comments.
✅ Monitors → Management → Tune Model Allow tuning the detection model of existing monitors (e.g., adjusting anomaly sensitivity/thresholds) without permission to create, edit, or delete monitors. Anyone with monitor edit access can already tune; grant this to extend tuning to roles that otherwise only respond to alerts.
✅ Monitors → Management → Agent Evaluation → Access Allow viewing agent evaluation monitors and their configurations.
✅ Monitors → Management → Agent Evaluation → Draft Allow creating and editing draft agent evaluation monitors.
✅ Monitors → Management → Agent Evaluation → Edit Allow creating, updating, and deleting agent evaluation monitors.
✅ Monitors → Management → Agent Metric → Access Allow viewing agent metric monitors and their configurations.
✅ Monitors → Management → Agent Metric → Draft Allow creating and editing draft agent metric monitors.
✅ Monitors → Management → Agent Metric → Edit Allow creating, updating, and deleting agent metric monitors.
✅ Monitors → Management → Agent Trajectory → Access Allow viewing agent trajectory monitors and their configurations.
✅ Monitors → Management → Agent Trajectory → Draft Allow creating and editing draft agent trajectory monitors.
✅ Monitors → Management → Agent Trajectory → Edit Allow creating, updating, and deleting agent trajectory monitors.
✅ Monitors → Management → Agent Validation → Access Allow viewing agent validation monitors and their configurations.
✅ Monitors → Management → Agent Validation → Draft Allow creating and editing draft agent validation monitors.
✅ Monitors → Management → Agent Validation → Edit Allow creating, updating, and deleting agent validation monitors.
✅ Monitors → Management → Comparison → Access Allow viewing comparison monitors and their configurations.
✅ Monitors → Management → Comparison → Draft Allow creating and editing draft comparison monitors.
✅ Monitors → Management → Comparison → Edit Allow creating, updating, and deleting comparison monitors.
✅ Monitors → Management → Custom Sql → Access Allow viewing custom SQL monitors and their configurations.
✅ Monitors → Management → Custom Sql → Draft Allow creating and editing draft custom SQL monitors.
✅ Monitors → Management → Custom Sql → Edit Allow creating, updating, and deleting custom SQL monitors.
✅ Monitors → Management → Job → Access Allow viewing job monitors and their configurations.
✅ Monitors → Management → Job → Draft Allow creating and editing draft job monitors.
✅ Monitors → Management → Job → Edit Allow creating, updating, and deleting job monitors.
✅ Monitors → Management → Json Schema → Access Allow viewing JSON schema monitors and their configurations.
✅ Monitors → Management → Json Schema → Draft Allow creating and editing draft JSON schema monitors.
✅ Monitors → Management → Json Schema → Edit Allow creating, updating, and deleting JSON schema monitors.
✅ Monitors → Management → Metric → Access Allow viewing metric monitors and their configurations.
✅ Monitors → Management → Metric → Draft Allow creating and editing draft metric monitors.
✅ Monitors → Management → Metric → Edit Allow creating, updating, and deleting metric monitors.
✅ Monitors → Management → Query Performance → Access Allow viewing query performance monitors and their configurations.
✅ Monitors → Management → Query Performance → Draft Allow creating and editing draft query performance monitors.
✅ Monitors → Management → Query Performance → Edit Allow creating, updating, and deleting query performance monitors.
✅ Monitors → Management → Table → Access Allow viewing table monitors and their configurations.
✅ Monitors → Management → Table → Draft Allow creating and editing draft table monitors before they are published.
✅ Monitors → Management → Table → Edit Allow creating, updating, and deleting table monitors.
✅ Monitors → Management → Validation → Access Allow viewing validation monitors and their configurations.
✅ Monitors → Management → Validation → Draft Allow creating and editing draft validation monitors.
✅ Monitors → Management → Validation → Edit Allow creating, updating, and deleting validation monitors.
✅ Performance → Access Allow accessing the performance dashboard and query analytics.
✅ Performance → Insights → Edit Allow acting on an insight, such as creating a ticket from it in a connected ticketing tool.
✅ Settings → Access Top-level permission for viewing account settings. This is used where there is not a more specific permission for a given setting.
✅ Settings → Edit Top-level permission for editing account settings. This is used where there is not a more specific permission for a given setting.
✅ Settings → List Iam Resources Allow listing IAM resource and permission definitions. Required for managing users, authorization groups, or roles, since these operations need to display available permissions.
✅ Settings → Agents → Access Allow viewing agent details, logs, and reachability information.
✅ Settings → AI Agents → Access Allow viewing AI agent settings.
✅ Settings → AI Agents → Edit Allow enabling, disabling, and configuring AI agents, including automated triage thresholds, usage limits, and per-domain overrides.
✅ Settings → API → Access Allow accessing API settings and the API explorer.
✅ Settings → API → Edit Allow managing personal API tokens.
✅ Settings → Authorization Groups → Access Allow viewing authorization groups and their members. Also required for user management, since group membership is displayed when managing users.
✅ Settings → Authorization Groups → Edit Allow creating, editing, and deleting authorization groups.
✅ Settings → Deployments → Access Allow viewing deployment details.
✅ Settings → Domains → Access Allow viewing domain settings.
✅ Settings → Domains → Edit Allow creating, editing, and deleting domains and related settings.
✅ Settings → Domains → List Allow listing available domains.
✅ Settings → Domains → View Detail Allow viewing detailed domain information and their assets.
✅ Settings → Ingestion → Access Allow viewing data ingestion settings and metrics.
✅ Settings → Ingestion → Edit Allow editing data ingestion settings.
✅ Settings → Integrations → Access Allow viewing integrations and their configurations.
✅ Settings → MCP Servers → Access Allow viewing custom MCP server connections and their configurations.
✅ Settings → Notifications → Access Allow viewing notification settings, audiences, and channels.
✅ Settings → Notifications → Edit Allow creating, editing, and deleting notification settings, audiences, and channels.
✅ Settings → OAuth Clients → Access Allow viewing OAuth clients and their configurations.
✅ Settings → PII Filters → Edit Allow creating, editing, and deleting PII filters.
✅ Settings → PII Filters → List Allow listing PII filters.
✅ Settings → PII Filters → View Metrics Allow viewing PII filter detection metrics.
✅ Settings → Roles → Access Allow viewing account roles and their permission definitions. Also required for managing authorization groups, since role assignment requires listing available roles.
✅ Settings → Secrets → Access Allow viewing secrets (names/metadata only, not values). Use `settings/secrets/view-values` to view secret values.
✅ Settings → Secrets → Edit Allow creating, editing, and deleting secrets.
❌ Settings → Secrets → View Values Allow viewing secret values. This grants access to sensitive credential data.
✅ Settings → User → Subscribe Weekly Digest Allow subscribing to or unsubscribing from the weekly digest email notification.
✅ Settings → Users → Access Allow viewing authentication and authorization settings.
✅ Settings → Users → Edit Allow managing users, authorization groups, SSO, and authorization provisioning (SCIM) settings.
✅ Settings → OAuth Clients → Personal OAuth Clients → Edit Allow creating and managing your own personal OAuth clients.
✅ Users → Account Owners Allow viewing the list of Account Owners in the account.
✅ Users → List Allow listing users in the account for features like assignee selection and @mentions.
*If a permission is not listed here, it is denied for this role.* ```yaml iam-role: version: "2023-03-15" name: mcd/domains-manager label: "Domains Manager" description: Allows access to all data + AI workflow features as well as managing personal API keys, data products, and domain-related settings such as domains, domain groups/users, ingestion, and notifications. restrictions_summary: Cannot edit most account settings except for domain-related settings. No billing or secret value access. recommended_for: Data/team/product leads who will assist in administration of domains and users. permissions: graphql/*: allow monitors/*: allow dashboard/*: allow data-products/*: allow data-exports/access: allow alerts/*: allow assets/*: allow lineage/*: allow mcp/*: allow ai-agents/*: allow agent-observability/access: allow agent-observability/*: allow performance/*: allow settings/access: allow settings/edit: allow settings/user/*: allow settings/users/access: allow settings/users/edit: allow settings/list-iam-resources: allow settings/authorization-groups/access: allow settings/authorization-groups/edit: allow settings/roles/access: allow settings/agents/access: allow settings/deployments/access: allow settings/ai-agents/*: allow settings/domains/*: allow settings/pii-filters/*: allow settings/integrations/access: allow settings/mcp-servers/access: allow settings/notifications/access: allow settings/notifications/*: allow settings/api/access: allow settings/api/edit: allow settings/oauth-clients/access: allow settings/oauth-clients/personal/edit: allow settings/ingestion/access: allow settings/ingestion/edit: allow settings/secrets/read: allow settings/secrets/edit: allow settings/secrets/view-values: deny users/*: allow ``` *** ### Editor Allows access to all data + AI workflow features, as well as managing personal API keys, their own data products, and ingestion, notifications, and AI agent settings. **Restrictions:** Cannot edit most account settings except for ingestion, notifications, and AI agent settings. No billing or secret value access. **Recommended for:** Data engineers that manage pipelines and data as a part of their job duties. **Role name:** `mcd/editor` **Built-in authorization group:** Editors (All)
Permission Description
✅ Agent Observability → Access Allow viewing the Agent Observability area, including the list of agents, their traces and spans, and the metrics and metadata describing them.
✅ Agent Observability → Content Allow viewing raw Agent Observability content. This includes conversation and trace prompts, completions, tool inputs and outputs, transcripts, and span attributes.
✅ AI Agents → Access Allow viewing AI agent features available to the account.
✅ AI Agents → Triage → Edit Allow running the Triage Agent to triage and update alerts.
✅ AI Agents → Troubleshooting → Access Allow running the Troubleshooting Agent on alerts and viewing its analyses.
✅ Alerts → Access Allow viewing alerts and their details.
✅ Alerts → Edit Allow editing alerts, including merging, splitting, and updating properties.
✅ Alerts → Update Status Allow updating alert status (e.g., acknowledging, resolving) and providing feedback on anomaly detections.
✅ Assets → Access Allow viewing the assets catalog and asset metadata.
✅ Assets → Edit Allow editing asset metadata in the catalog.
✅ Dashboard → Access Allow viewing dashboards.
✅ Dashboard → Edit Allow creating and editing all dashboards in the account.
✅ Dashboard → Edit Their Own Allow creating and editing only dashboards the current user created. Those with `dashboard/edit` permission can also edit these dashboards.
✅ Data Exports → Access Allow accessing and downloading data exports.
✅ Data Products → Access Allow viewing data products.
✅ Data Products → Edit Their Own Allow creating and editing only data products the current user created. Those with `data-products/edit` permission can also edit these data products.
✅ GraphQL → Mutate Allow making modifications (executing mutations) via the GraphQL API. This is required for any writes. This is always asserted in addition to any more specific permissions.
✅ GraphQL → Query Allow reading data (executing queries) via the GraphQL API. This is required for baseline read-only access to the system, and is always asserted in addition to any more specific permissions.
✅ Lineage → Access Allow viewing lineage graphs and their metadata.
✅ Lineage → Edit Allow creating and editing lineage metadata (nodes, edges, etc.).
✅ MCP → Access Allow authenticating to MCP and using read-only MCP tools.
✅ MCP → Edit Allow authenticating to MCP and using tools that modify account data or configuration.
✅ Monitors → Aggregates Allow viewing monitor metrics and aggregate summaries without full monitor access. Used for dashboards and reporting.
✅ Monitors → Data Sampling → Access Allow accessing sampled data from tables. Required to view sample data in the UI.
✅ Monitors → Data Sampling → Download Allow downloading sampled data from tables.
✅ Monitors → Exceptions → Access Allow viewing monitor exception activity logs.
✅ Monitors → Exceptions → Edit Allow editing monitor exceptions, including updating attributes and adding comments.
✅ Monitors → Management → Tune Model Allow tuning the detection model of existing monitors (e.g., adjusting anomaly sensitivity/thresholds) without permission to create, edit, or delete monitors. Anyone with monitor edit access can already tune; grant this to extend tuning to roles that otherwise only respond to alerts.
✅ Monitors → Management → Agent Evaluation → Access Allow viewing agent evaluation monitors and their configurations.
✅ Monitors → Management → Agent Evaluation → Draft Allow creating and editing draft agent evaluation monitors.
✅ Monitors → Management → Agent Evaluation → Edit Allow creating, updating, and deleting agent evaluation monitors.
✅ Monitors → Management → Agent Metric → Access Allow viewing agent metric monitors and their configurations.
✅ Monitors → Management → Agent Metric → Draft Allow creating and editing draft agent metric monitors.
✅ Monitors → Management → Agent Metric → Edit Allow creating, updating, and deleting agent metric monitors.
✅ Monitors → Management → Agent Trajectory → Access Allow viewing agent trajectory monitors and their configurations.
✅ Monitors → Management → Agent Trajectory → Draft Allow creating and editing draft agent trajectory monitors.
✅ Monitors → Management → Agent Trajectory → Edit Allow creating, updating, and deleting agent trajectory monitors.
✅ Monitors → Management → Agent Validation → Access Allow viewing agent validation monitors and their configurations.
✅ Monitors → Management → Agent Validation → Draft Allow creating and editing draft agent validation monitors.
✅ Monitors → Management → Agent Validation → Edit Allow creating, updating, and deleting agent validation monitors.
✅ Monitors → Management → Comparison → Access Allow viewing comparison monitors and their configurations.
✅ Monitors → Management → Comparison → Draft Allow creating and editing draft comparison monitors.
✅ Monitors → Management → Comparison → Edit Allow creating, updating, and deleting comparison monitors.
✅ Monitors → Management → Custom Sql → Access Allow viewing custom SQL monitors and their configurations.
✅ Monitors → Management → Custom Sql → Draft Allow creating and editing draft custom SQL monitors.
✅ Monitors → Management → Custom Sql → Edit Allow creating, updating, and deleting custom SQL monitors.
✅ Monitors → Management → Job → Access Allow viewing job monitors and their configurations.
✅ Monitors → Management → Job → Draft Allow creating and editing draft job monitors.
✅ Monitors → Management → Job → Edit Allow creating, updating, and deleting job monitors.
✅ Monitors → Management → Json Schema → Access Allow viewing JSON schema monitors and their configurations.
✅ Monitors → Management → Json Schema → Draft Allow creating and editing draft JSON schema monitors.
✅ Monitors → Management → Json Schema → Edit Allow creating, updating, and deleting JSON schema monitors.
✅ Monitors → Management → Metric → Access Allow viewing metric monitors and their configurations.
✅ Monitors → Management → Metric → Draft Allow creating and editing draft metric monitors.
✅ Monitors → Management → Metric → Edit Allow creating, updating, and deleting metric monitors.
✅ Monitors → Management → Query Performance → Access Allow viewing query performance monitors and their configurations.
✅ Monitors → Management → Query Performance → Draft Allow creating and editing draft query performance monitors.
✅ Monitors → Management → Query Performance → Edit Allow creating, updating, and deleting query performance monitors.
✅ Monitors → Management → Table → Access Allow viewing table monitors and their configurations.
✅ Monitors → Management → Table → Draft Allow creating and editing draft table monitors before they are published.
✅ Monitors → Management → Table → Edit Allow creating, updating, and deleting table monitors.
✅ Monitors → Management → Validation → Access Allow viewing validation monitors and their configurations.
✅ Monitors → Management → Validation → Draft Allow creating and editing draft validation monitors.
✅ Monitors → Management → Validation → Edit Allow creating, updating, and deleting validation monitors.
✅ Performance → Access Allow accessing the performance dashboard and query analytics.
✅ Performance → Insights → Edit Allow acting on an insight, such as creating a ticket from it in a connected ticketing tool.
✅ Settings → Access Top-level permission for viewing account settings. This is used where there is not a more specific permission for a given setting.
✅ Settings → Agents → Access Allow viewing agent details, logs, and reachability information.
✅ Settings → AI Agents → Access Allow viewing AI agent settings.
✅ Settings → AI Agents → Edit Allow enabling, disabling, and configuring AI agents, including automated triage thresholds, usage limits, and per-domain overrides.
✅ Settings → API → Access Allow accessing API settings and the API explorer.
✅ Settings → API → Edit Allow managing personal API tokens.
✅ Settings → Deployments → Access Allow viewing deployment details.
✅ Settings → Domains → List Allow listing available domains.
✅ Settings → Domains → View Detail Allow viewing detailed domain information and their assets.
✅ Settings → Ingestion → Access Allow viewing data ingestion settings and metrics.
✅ Settings → Ingestion → Edit Allow editing data ingestion settings.
✅ Settings → Integrations → Access Allow viewing integrations and their configurations.
✅ Settings → MCP Servers → Access Allow viewing custom MCP server connections and their configurations.
✅ Settings → Notifications → Access Allow viewing notification settings, audiences, and channels.
✅ Settings → Notifications → Edit Allow creating, editing, and deleting notification settings, audiences, and channels.
✅ Settings → OAuth Clients → Access Allow viewing OAuth clients and their configurations.
✅ Settings → PII Filters → List Allow listing PII filters.
✅ Settings → PII Filters → View Metrics Allow viewing PII filter detection metrics.
✅ Settings → Secrets → Access Allow viewing secrets (names/metadata only, not values). Use `settings/secrets/view-values` to view secret values.
✅ Settings → Secrets → Edit Allow creating, editing, and deleting secrets.
❌ Settings → Secrets → View Values Allow viewing secret values. This grants access to sensitive credential data.
✅ Settings → User → Subscribe Weekly Digest Allow subscribing to or unsubscribing from the weekly digest email notification.
✅ Settings → OAuth Clients → Personal OAuth Clients → Edit Allow creating and managing your own personal OAuth clients.
✅ Users → Account Owners Allow viewing the list of Account Owners in the account.
✅ Users → List Allow listing users in the account for features like assignee selection and @mentions.
*If a permission is not listed here, it is denied for this role.* ```yaml iam-role: version: "2022-03-17" name: mcd/editor label: "Editor" description: Allows access to all data + AI workflow features, as well as managing personal API keys, their own data products, and ingestion, notifications, and AI agent settings. restrictions_summary: Cannot edit most account settings except for ingestion, notifications, and AI agent settings. No billing or secret value access. recommended_for: Data engineers that manage pipelines and data as a part of their job duties. permissions: graphql/*: allow monitors/*: allow dashboard/*: allow data-products/access: allow data-products/edit-their-own: allow data-exports/access: allow alerts/*: allow assets/*: allow lineage/*: allow mcp/*: allow ai-agents/*: allow agent-observability/access: allow agent-observability/*: allow performance/*: allow settings/access: allow settings/agents/access: allow settings/ai-agents/access: allow settings/ai-agents/edit: allow settings/deployments/access: allow settings/api/access: allow settings/api/edit: allow settings/oauth-clients/access: allow settings/oauth-clients/personal/edit: allow settings/domains/list: allow settings/domains/view-detail: allow settings/integrations/access: allow settings/mcp-servers/access: allow settings/ingestion/access: allow settings/ingestion/edit: allow settings/user/subscribe-weekly-digest: allow settings/pii-filters/list: allow settings/pii-filters/view-metrics: allow settings/notifications/*: allow settings/secrets/read: allow settings/secrets/edit: allow settings/secrets/view-values: deny users/list: allow users/account-owners: allow ``` *** ### Monitor Editor Allows access to most data + AI workflow features, as well as managing personal API keys, their own data products, and notifications settings. **Restrictions:** Monitor-focused settings only—no catalog editing, account management, or billing/secret value access. **Recommended for:** Those who will add metric and validation monitors to key tables and pipelines. **Role name:** `mcd/monitor-editor` **Built-in authorization group:** Monitor Editors (All)
Permission Description
✅ Agent Observability → Access Allow viewing the Agent Observability area, including the list of agents, their traces and spans, and the metrics and metadata describing them.
✅ Agent Observability → Content Allow viewing raw Agent Observability content. This includes conversation and trace prompts, completions, tool inputs and outputs, transcripts, and span attributes.
✅ AI Agents → Access Allow viewing AI agent features available to the account.
✅ AI Agents → Triage → Edit Allow running the Triage Agent to triage and update alerts.
✅ AI Agents → Troubleshooting → Access Allow running the Troubleshooting Agent on alerts and viewing its analyses.
✅ Alerts → Access Allow viewing alerts and their details.
✅ Alerts → Edit Allow editing alerts, including merging, splitting, and updating properties.
✅ Alerts → Update Status Allow updating alert status (e.g., acknowledging, resolving) and providing feedback on anomaly detections.
✅ Assets → Access Allow viewing the assets catalog and asset metadata.
✅ Dashboard → Access Allow viewing dashboards.
✅ Dashboard → Edit Allow creating and editing all dashboards in the account.
✅ Dashboard → Edit Their Own Allow creating and editing only dashboards the current user created. Those with `dashboard/edit` permission can also edit these dashboards.
✅ Data Exports → Access Allow accessing and downloading data exports.
✅ Data Products → Access Allow viewing data products.
✅ Data Products → Edit Their Own Allow creating and editing only data products the current user created. Those with `data-products/edit` permission can also edit these data products.
✅ GraphQL → Mutate Allow making modifications (executing mutations) via the GraphQL API. This is required for any writes. This is always asserted in addition to any more specific permissions.
✅ GraphQL → Query Allow reading data (executing queries) via the GraphQL API. This is required for baseline read-only access to the system, and is always asserted in addition to any more specific permissions.
✅ Lineage → Access Allow viewing lineage graphs and their metadata.
✅ Lineage → Edit Allow creating and editing lineage metadata (nodes, edges, etc.).
✅ MCP → Access Allow authenticating to MCP and using read-only MCP tools.
✅ MCP → Edit Allow authenticating to MCP and using tools that modify account data or configuration.
✅ Monitors → Aggregates Allow viewing monitor metrics and aggregate summaries without full monitor access. Used for dashboards and reporting.
✅ Monitors → Data Sampling → Access Allow accessing sampled data from tables. Required to view sample data in the UI.
✅ Monitors → Data Sampling → Download Allow downloading sampled data from tables.
✅ Monitors → Exceptions → Access Allow viewing monitor exception activity logs.
✅ Monitors → Exceptions → Edit Allow editing monitor exceptions, including updating attributes and adding comments.
✅ Monitors → Management → Tune Model Allow tuning the detection model of existing monitors (e.g., adjusting anomaly sensitivity/thresholds) without permission to create, edit, or delete monitors. Anyone with monitor edit access can already tune; grant this to extend tuning to roles that otherwise only respond to alerts.
✅ Monitors → Management → Agent Evaluation → Access Allow viewing agent evaluation monitors and their configurations.
✅ Monitors → Management → Agent Evaluation → Draft Allow creating and editing draft agent evaluation monitors.
✅ Monitors → Management → Agent Evaluation → Edit Allow creating, updating, and deleting agent evaluation monitors.
✅ Monitors → Management → Agent Metric → Access Allow viewing agent metric monitors and their configurations.
✅ Monitors → Management → Agent Metric → Draft Allow creating and editing draft agent metric monitors.
✅ Monitors → Management → Agent Metric → Edit Allow creating, updating, and deleting agent metric monitors.
✅ Monitors → Management → Agent Trajectory → Access Allow viewing agent trajectory monitors and their configurations.
✅ Monitors → Management → Agent Trajectory → Draft Allow creating and editing draft agent trajectory monitors.
✅ Monitors → Management → Agent Trajectory → Edit Allow creating, updating, and deleting agent trajectory monitors.
✅ Monitors → Management → Agent Validation → Access Allow viewing agent validation monitors and their configurations.
✅ Monitors → Management → Agent Validation → Draft Allow creating and editing draft agent validation monitors.
✅ Monitors → Management → Agent Validation → Edit Allow creating, updating, and deleting agent validation monitors.
✅ Monitors → Management → Comparison → Access Allow viewing comparison monitors and their configurations.
✅ Monitors → Management → Comparison → Draft Allow creating and editing draft comparison monitors.
✅ Monitors → Management → Comparison → Edit Allow creating, updating, and deleting comparison monitors.
✅ Monitors → Management → Custom Sql → Access Allow viewing custom SQL monitors and their configurations.
✅ Monitors → Management → Custom Sql → Draft Allow creating and editing draft custom SQL monitors.
✅ Monitors → Management → Custom Sql → Edit Allow creating, updating, and deleting custom SQL monitors.
✅ Monitors → Management → Job → Access Allow viewing job monitors and their configurations.
✅ Monitors → Management → Job → Draft Allow creating and editing draft job monitors.
✅ Monitors → Management → Job → Edit Allow creating, updating, and deleting job monitors.
✅ Monitors → Management → Json Schema → Access Allow viewing JSON schema monitors and their configurations.
✅ Monitors → Management → Json Schema → Draft Allow creating and editing draft JSON schema monitors.
✅ Monitors → Management → Json Schema → Edit Allow creating, updating, and deleting JSON schema monitors.
✅ Monitors → Management → Metric → Access Allow viewing metric monitors and their configurations.
✅ Monitors → Management → Metric → Draft Allow creating and editing draft metric monitors.
✅ Monitors → Management → Metric → Edit Allow creating, updating, and deleting metric monitors.
✅ Monitors → Management → Query Performance → Access Allow viewing query performance monitors and their configurations.
✅ Monitors → Management → Query Performance → Draft Allow creating and editing draft query performance monitors.
✅ Monitors → Management → Query Performance → Edit Allow creating, updating, and deleting query performance monitors.
✅ Monitors → Management → Table → Access Allow viewing table monitors and their configurations.
✅ Monitors → Management → Table → Draft Allow creating and editing draft table monitors before they are published.
✅ Monitors → Management → Table → Edit Allow creating, updating, and deleting table monitors.
✅ Monitors → Management → Validation → Access Allow viewing validation monitors and their configurations.
✅ Monitors → Management → Validation → Draft Allow creating and editing draft validation monitors.
✅ Monitors → Management → Validation → Edit Allow creating, updating, and deleting validation monitors.
✅ Performance → Access Allow accessing the performance dashboard and query analytics.
✅ Performance → Insights → Edit Allow acting on an insight, such as creating a ticket from it in a connected ticketing tool.
✅ Settings → Access Top-level permission for viewing account settings. This is used where there is not a more specific permission for a given setting.
✅ Settings → Agents → Access Allow viewing agent details, logs, and reachability information.
✅ Settings → AI Agents → Access Allow viewing AI agent settings.
✅ Settings → API → Access Allow accessing API settings and the API explorer.
✅ Settings → API → Edit Allow managing personal API tokens.
✅ Settings → Deployments → Access Allow viewing deployment details.
✅ Settings → Domains → List Allow listing available domains.
✅ Settings → Domains → View Detail Allow viewing detailed domain information and their assets.
✅ Settings → Integrations → Access Allow viewing integrations and their configurations.
✅ Settings → MCP Servers → Access Allow viewing custom MCP server connections and their configurations.
✅ Settings → Notifications → Access Allow viewing notification settings, audiences, and channels.
✅ Settings → Notifications → Edit Allow creating, editing, and deleting notification settings, audiences, and channels.
✅ Settings → OAuth Clients → Access Allow viewing OAuth clients and their configurations.
✅ Settings → PII Filters → List Allow listing PII filters.
✅ Settings → PII Filters → View Metrics Allow viewing PII filter detection metrics.
✅ Settings → Secrets → Access Allow viewing secrets (names/metadata only, not values). Use `settings/secrets/view-values` to view secret values.
✅ Settings → Secrets → Edit Allow creating, editing, and deleting secrets.
❌ Settings → Secrets → View Values Allow viewing secret values. This grants access to sensitive credential data.
✅ Settings → User → Subscribe Weekly Digest Allow subscribing to or unsubscribing from the weekly digest email notification.
✅ Settings → OAuth Clients → Personal OAuth Clients → Edit Allow creating and managing your own personal OAuth clients.
✅ Users → Account Owners Allow viewing the list of Account Owners in the account.
✅ Users → List Allow listing users in the account for features like assignee selection and @mentions.
*If a permission is not listed here, it is denied for this role.* ```yaml iam-role: version: "2025-03-25" name: mcd/monitor-editor label: "Monitor Editor" description: Allows access to most data + AI workflow features, as well as managing personal API keys, their own data products, and notifications settings. restrictions_summary: Monitor-focused settings only—no catalog editing, account management, or billing/secret value access. recommended_for: Those who will add metric and validation monitors to key tables and pipelines. permissions: graphql/*: allow monitors/*: allow dashboard/*: allow data-products/access: allow data-products/edit-their-own: allow data-exports/access: allow alerts/*: allow assets/access: allow lineage/*: allow mcp/*: allow ai-agents/*: allow agent-observability/access: allow agent-observability/*: allow performance/*: allow settings/access: allow settings/agents/access: allow settings/ai-agents/access: allow settings/deployments/access: allow settings/api/access: allow settings/api/edit: allow settings/oauth-clients/access: allow settings/oauth-clients/personal/edit: allow settings/domains/list: allow settings/domains/view-detail: allow settings/integrations/access: allow settings/mcp-servers/access: allow settings/user/subscribe-weekly-digest: allow settings/pii-filters/list: allow settings/pii-filters/view-metrics: allow settings/notifications/*: allow settings/secrets/read: allow settings/secrets/edit: allow settings/secrets/view-values: deny users/list: allow users/account-owners: allow ``` *** ### Responder Allows read-only access to data + AI workflow features plus alert response actions. May also draft monitors. **Restrictions:** Only able to respond to alerts. No changing account settings and no billing or secrets access. **Recommended for:** Those who triage and respond to alerts but will not manage Monte Carlo configuration/settings. **Role name:** `mcd/responder` **Built-in authorization group:** Responders (All)
Permission Description
✅ Agent Observability → Access Allow viewing the Agent Observability area, including the list of agents, their traces and spans, and the metrics and metadata describing them.
✅ Agent Observability → Content Allow viewing raw Agent Observability content. This includes conversation and trace prompts, completions, tool inputs and outputs, transcripts, and span attributes.
✅ AI Agents → Access Allow viewing AI agent features available to the account.
✅ AI Agents → Triage → Edit Allow running the Triage Agent to triage and update alerts.
✅ AI Agents → Troubleshooting → Access Allow running the Troubleshooting Agent on alerts and viewing its analyses.
✅ Alerts → Access Allow viewing alerts and their details.
✅ Alerts → Edit Allow editing alerts, including merging, splitting, and updating properties.
✅ Alerts → Update Status Allow updating alert status (e.g., acknowledging, resolving) and providing feedback on anomaly detections.
✅ Assets → Access Allow viewing the assets catalog and asset metadata.
✅ Dashboard → Access Allow viewing dashboards.
✅ Data Exports → Access Allow accessing and downloading data exports.
✅ Data Products → Access Allow viewing data products.
✅ GraphQL → Mutate Allow making modifications (executing mutations) via the GraphQL API. This is required for any writes. This is always asserted in addition to any more specific permissions.
✅ GraphQL → Query Allow reading data (executing queries) via the GraphQL API. This is required for baseline read-only access to the system, and is always asserted in addition to any more specific permissions.
✅ Lineage → Access Allow viewing lineage graphs and their metadata.
✅ MCP → Access Allow authenticating to MCP and using read-only MCP tools.
✅ MCP → Edit Allow authenticating to MCP and using tools that modify account data or configuration.
✅ Monitors → Aggregates Allow viewing monitor metrics and aggregate summaries without full monitor access. Used for dashboards and reporting.
✅ Monitors → Data Sampling → Access Allow accessing sampled data from tables. Required to view sample data in the UI.
✅ Monitors → Data Sampling → Download Allow downloading sampled data from tables.
✅ Monitors → Exceptions → Access Allow viewing monitor exception activity logs.
✅ Monitors → Exceptions → Edit Allow editing monitor exceptions, including updating attributes and adding comments.
✅ Monitors → Management → Agent Evaluation → Access Allow viewing agent evaluation monitors and their configurations.
✅ Monitors → Management → Agent Evaluation → Draft Allow creating and editing draft agent evaluation monitors.
✅ Monitors → Management → Agent Metric → Access Allow viewing agent metric monitors and their configurations.
✅ Monitors → Management → Agent Metric → Draft Allow creating and editing draft agent metric monitors.
✅ Monitors → Management → Agent Trajectory → Access Allow viewing agent trajectory monitors and their configurations.
✅ Monitors → Management → Agent Trajectory → Draft Allow creating and editing draft agent trajectory monitors.
✅ Monitors → Management → Agent Validation → Access Allow viewing agent validation monitors and their configurations.
✅ Monitors → Management → Agent Validation → Draft Allow creating and editing draft agent validation monitors.
✅ Monitors → Management → Comparison → Access Allow viewing comparison monitors and their configurations.
✅ Monitors → Management → Comparison → Draft Allow creating and editing draft comparison monitors.
✅ Monitors → Management → Custom Sql → Access Allow viewing custom SQL monitors and their configurations.
✅ Monitors → Management → Custom Sql → Draft Allow creating and editing draft custom SQL monitors.
✅ Monitors → Management → Job → Access Allow viewing job monitors and their configurations.
✅ Monitors → Management → Job → Draft Allow creating and editing draft job monitors.
✅ Monitors → Management → Json Schema → Access Allow viewing JSON schema monitors and their configurations.
✅ Monitors → Management → Json Schema → Draft Allow creating and editing draft JSON schema monitors.
✅ Monitors → Management → Metric → Access Allow viewing metric monitors and their configurations.
✅ Monitors → Management → Metric → Draft Allow creating and editing draft metric monitors.
✅ Monitors → Management → Query Performance → Access Allow viewing query performance monitors and their configurations.
✅ Monitors → Management → Query Performance → Draft Allow creating and editing draft query performance monitors.
✅ Monitors → Management → Table → Access Allow viewing table monitors and their configurations.
✅ Monitors → Management → Table → Draft Allow creating and editing draft table monitors before they are published.
✅ Monitors → Management → Validation → Access Allow viewing validation monitors and their configurations.
✅ Monitors → Management → Validation → Draft Allow creating and editing draft validation monitors.
✅ Performance → Access Allow accessing the performance dashboard and query analytics.
✅ Performance → Insights → Edit Allow acting on an insight, such as creating a ticket from it in a connected ticketing tool.
✅ Settings → Domains → List Allow listing available domains.
✅ Settings → Domains → View Detail Allow viewing detailed domain information and their assets.
✅ Settings → Integrations → Access Allow viewing integrations and their configurations.
✅ Settings → MCP Servers → Access Allow viewing custom MCP server connections and their configurations.
✅ Settings → Notifications → Access Allow viewing notification settings, audiences, and channels.
✅ Settings → PII Filters → View Metrics Allow viewing PII filter detection metrics.
✅ Users → Account Owners Allow viewing the list of Account Owners in the account.
✅ Users → List Allow listing users in the account for features like assignee selection and @mentions.
*If a permission is not listed here, it is denied for this role.* ```yaml iam-role: version: "2023-09-18" name: mcd/responder label: "Responder" description: Allows read-only access to data + AI workflow features plus alert response actions. May also draft monitors. restrictions_summary: Only able to respond to alerts. No changing account settings and no billing or secrets access. recommended_for: Those who triage and respond to alerts but will not manage Monte Carlo configuration/settings. permissions: graphql/*: allow monitors/read: allow monitors/draft: allow monitors/management/propose: allow monitors/exceptions/*: allow dashboard/read: allow alerts/*: allow assets/access: allow data-products/access: allow data-exports/access: allow lineage/read: allow mcp/*: allow ai-agents/*: allow agent-observability/access: allow agent-observability/read: allow performance/read: allow performance/insights/*: allow settings/domains/list: allow settings/domains/view-detail: allow settings/integrations/access: allow settings/mcp-servers/access: allow settings/notifications/access: allow settings/pii-filters/view-metrics: allow users/list: allow users/account-owners: allow ``` *** ### Viewer Allows read-only access to data + AI workflow features. May also draft monitors. **Restrictions:** Mostly read only. No changing account settings, no billing access, and no access to secret values. **Recommended for:** Those who may benefit from understanding data + AI quality issues but who are not responsible for fixing them. **Role name:** `mcd/viewer` **Built-in authorization group:** Viewers (All)
Permission Description
✅ Agent Observability → Access Allow viewing the Agent Observability area, including the list of agents, their traces and spans, and the metrics and metadata describing them.
✅ Agent Observability → Content Allow viewing raw Agent Observability content. This includes conversation and trace prompts, completions, tool inputs and outputs, transcripts, and span attributes.
✅ AI Agents → Access Allow viewing AI agent features available to the account.
✅ AI Agents → Troubleshooting → Access Allow running the Troubleshooting Agent on alerts and viewing its analyses.
✅ Alerts → Access Allow viewing alerts and their details.
✅ Assets → Access Allow viewing the assets catalog and asset metadata.
✅ Dashboard → Access Allow viewing dashboards.
✅ Data Exports → Access Allow accessing and downloading data exports.
✅ Data Products → Access Allow viewing data products.
✅ GraphQL → Query Allow reading data (executing queries) via the GraphQL API. This is required for baseline read-only access to the system, and is always asserted in addition to any more specific permissions.
✅ Lineage → Access Allow viewing lineage graphs and their metadata.
✅ MCP → Access Allow authenticating to MCP and using read-only MCP tools.
✅ Monitors → Aggregates Allow viewing monitor metrics and aggregate summaries without full monitor access. Used for dashboards and reporting.
✅ Monitors → Data Sampling → Access Allow accessing sampled data from tables. Required to view sample data in the UI.
✅ Monitors → Data Sampling → Download Allow downloading sampled data from tables.
✅ Monitors → Exceptions → Access Allow viewing monitor exception activity logs.
✅ Monitors → Management → Agent Evaluation → Access Allow viewing agent evaluation monitors and their configurations.
✅ Monitors → Management → Agent Evaluation → Draft Allow creating and editing draft agent evaluation monitors.
✅ Monitors → Management → Agent Metric → Access Allow viewing agent metric monitors and their configurations.
✅ Monitors → Management → Agent Metric → Draft Allow creating and editing draft agent metric monitors.
✅ Monitors → Management → Agent Trajectory → Access Allow viewing agent trajectory monitors and their configurations.
✅ Monitors → Management → Agent Trajectory → Draft Allow creating and editing draft agent trajectory monitors.
✅ Monitors → Management → Agent Validation → Access Allow viewing agent validation monitors and their configurations.
✅ Monitors → Management → Agent Validation → Draft Allow creating and editing draft agent validation monitors.
✅ Monitors → Management → Comparison → Access Allow viewing comparison monitors and their configurations.
✅ Monitors → Management → Comparison → Draft Allow creating and editing draft comparison monitors.
✅ Monitors → Management → Custom Sql → Access Allow viewing custom SQL monitors and their configurations.
✅ Monitors → Management → Custom Sql → Draft Allow creating and editing draft custom SQL monitors.
✅ Monitors → Management → Job → Access Allow viewing job monitors and their configurations.
✅ Monitors → Management → Job → Draft Allow creating and editing draft job monitors.
✅ Monitors → Management → Json Schema → Access Allow viewing JSON schema monitors and their configurations.
✅ Monitors → Management → Json Schema → Draft Allow creating and editing draft JSON schema monitors.
✅ Monitors → Management → Metric → Access Allow viewing metric monitors and their configurations.
✅ Monitors → Management → Metric → Draft Allow creating and editing draft metric monitors.
✅ Monitors → Management → Query Performance → Access Allow viewing query performance monitors and their configurations.
✅ Monitors → Management → Query Performance → Draft Allow creating and editing draft query performance monitors.
✅ Monitors → Management → Table → Access Allow viewing table monitors and their configurations.
✅ Monitors → Management → Table → Draft Allow creating and editing draft table monitors before they are published.
✅ Monitors → Management → Validation → Access Allow viewing validation monitors and their configurations.
✅ Monitors → Management → Validation → Draft Allow creating and editing draft validation monitors.
✅ Performance → Access Allow accessing the performance dashboard and query analytics.
✅ Settings → Domains → List Allow listing available domains.
✅ Settings → Domains → View Detail Allow viewing detailed domain information and their assets.
✅ Settings → Integrations → Access Allow viewing integrations and their configurations.
✅ Settings → MCP Servers → Access Allow viewing custom MCP server connections and their configurations.
✅ Settings → Notifications → Access Allow viewing notification settings, audiences, and channels.
✅ Settings → PII Filters → View Metrics Allow viewing PII filter detection metrics.
✅ Settings → Secrets → Access Allow viewing secrets (names/metadata only, not values). Use `settings/secrets/view-values` to view secret values.
❌ Settings → Secrets → View Values Allow viewing secret values. This grants access to sensitive credential data.
✅ Settings → User → Subscribe Weekly Digest Allow subscribing to or unsubscribing from the weekly digest email notification.
✅ Users → Account Owners Allow viewing the list of Account Owners in the account.
✅ Users → List Allow listing users in the account for features like assignee selection and @mentions.
*If a permission is not listed here, it is denied for this role.* ```yaml iam-role: version: "2022-03-17" name: mcd/viewer label: "Viewer" description: Allows read-only access to data + AI workflow features. May also draft monitors. restrictions_summary: Mostly read only. No changing account settings, no billing access, and no access to secret values. recommended_for: Those who may benefit from understanding data + AI quality issues but who are not responsible for fixing them. permissions: graphql/read: allow monitors/read: allow monitors/draft: allow monitors/management/propose: allow dashboard/read: allow data-products/access: allow data-exports/access: allow alerts/read: allow assets/read: allow lineage/read: allow mcp/read: allow ai-agents/read: allow agent-observability/access: allow agent-observability/read: allow performance/read: allow settings/domains/list: allow settings/domains/view-detail: allow settings/integrations/access: allow settings/mcp-servers/access: allow settings/notifications/access: allow settings/pii-filters/view-metrics: allow settings/user/subscribe-weekly-digest: allow settings/secrets/read: allow settings/secrets/view-values: deny users/list: allow users/account-owners: allow ``` ***