IAM Resources and Permissions

This page lists all IAM resources and their related permissions in Monte Carlo.
This information is useful when configuring custom account roles.

Permission Types

Permissions have a type that indicates the kind of operations they authorize. The type is indicated by an icon next to the permission name:

• 📖 read – Authorizes operations that involve viewing/querying (read only--no changes)
• ✏️ write – Authorizes operations that involve some form of modification (create, update, delete, etc.)

In role definitions, you can leverage these to allow or deny permissions of a specific type. For example, if you wanted to grant all read type operations to a resource (but deny all write type operations), you can use a policy statement like monitors/read: allow.

GraphQL

Controls core access to the GraphQL API for executing queries and mutations.

Monitors

Controls access to data + AI monitors.

Management

Controls creation, editing, drafting, and tuning of monitors by type. Use type-based/wildcard policies (e.g., monitors/management/write, monitors/management/*) to grant across all monitor types.

Table

Controls access to table monitors (freshness, volume, and asset selection-based monitoring).

Metric

Controls access to metric/stats monitors.

Validation

Controls access to validation rule monitors.

Comparison

Controls access to comparison monitors.

Custom Sql

Controls access to custom SQL monitors and SQL templates.

Json Schema

Controls access to JSON schema monitors.

Agent Evaluation

Controls access to agent evaluation monitors.

Agent Trajectory

Controls access to agent trajectory monitors.

Agent Metric

Controls access to agent metric monitors.

Agent Validation

Controls access to agent validation monitors.

Query Performance

Controls access to query performance monitors.

Data Sampling

Controls access to sampled data from monitored tables.

Exceptions

Controls access to monitor exception management for tracking and commenting on breached rows.

Dashboard

Controls access to dashboards for visualizing data + AI quality metrics and insights.

Data Products

Controls access to data products for organizing and tracking related data + AI assets.

Data Exports

Controls access to data exports for downloading reports and data.

Alerts

Controls access to alerts for viewing and managing data + AI quality issues.

Assets

Controls access to the assets catalog for exploring and managing asset metadata.

Lineage

Controls access to data + AI lineage features for understanding and monitoring data + AI flows.

Performance

Controls access to performance analytics to support query and warehouse analysis and optimization.

Users

Controls non-admin access to other account users.

Settings

Controls access to account settings and configuration.

User

Controls self-managed, user-specific settings and preferences.

Users

Controls management of user accounts, including invitations and user attributes.

Authorization Groups

Controls management of authorization groups and their membership, including auth provisioning (SCIM) settings.

Roles

Controls management of custom account roles and their permission definitions.

SSO

Controls access to single sign-on (SSO) configuration settings.

Agents

Controls access to agent management for data collection agents.

AI Agents

Controls who can administer the settings for Monte Carlo's AI agents, such as enabling or disabling an agent and configuring automated triage. This is separate from the permissions that control who can run the agents.

Domains

Controls access to domain management for organizing data + AI assets.

PII Filters

Controls access to PII (Personally Identifiable Information) filter management.

Integrations

Controls access to integrations settings.

Notifications

Controls access to notification settings, audiences, and channels.

API

Controls access to API tokens and the API explorer.

OAuth Clients

Controls access to OAuth 2.0 client credentials for machine-to-machine authentication.

Personal OAuth Clients

Personal (user) OAuth clients.

Service OAuth Clients

Service-account OAuth clients.

Ingestion

Controls access to data ingestion settings and metrics for the account.

Secrets

Controls access to secrets management for storing sensitive credentials.

Billing

Controls access to billing information and invoices.

Network

Controls network access control settings such as IP restrictions for data being pushed into our system via API, Integration Gateway, or other push-based services.

Session

Controls account-level session timeout settings, including absolute session lifetime and inactivity timeout.

MCP

Controls access to the Monte Carlo Model Context Protocol (MCP) interface used by AI agents to query and act on the account.

AI Agents

Controls access to Monte Carlo's AI agents, such as the Troubleshooting Agent and the Triage Agent.

Troubleshooting

Controls access to the Troubleshooting Agent, which investigates alerts to identify probable root causes.

Triage

Controls access to the Triage Agent, which triages alerts and updates their status.