IAM Resources and Permissions

This page lists all IAM resources and their related permissions in Monte Carlo. This information is useful when configuring custom account roles.

Permission Types

Permissions have a type that indicates the kind of operations they authorize. The type is indicated by an icon next to the permission name:

• 📖 read – Authorizes operations that involve viewing/querying (read only--no changes)
• ✏️ write – Authorizes operations that involve some form of modification (create, update, delete, etc.)

In role definitions, you can leverage these to allow or deny permissions of a specific type. For example, if you wanted to grant all read type operations to a resource (but deny all write type operations), you can use a policy statement like monitors/read: allow.

GraphQL

Controls core access to the GraphQL API for executing queries and mutations.

Permission	Description
Query 📖 graphql/query	Allow reading data (executing queries) via the GraphQL API. This is required for baseline read-only access to the system, and is always asserted in addition to any more specific permissions.
Mutate ✏️ graphql/mutate	Allow making modifications (executing mutations) via the GraphQL API. This is required for any writes. This is always asserted in addition to any more specific permissions.

Monitors

Controls access to data + AI monitors.

Permission	Description
Access 📖 monitors/access	Allow viewing monitors and their configurations.
Aggregates 📖 monitors/aggregates	Allow viewing monitor metrics and aggregate summaries without full monitor access. Used for dashboards and reporting.
Edit ✏️ monitors/edit	Allow creating, updating, and deleting monitors.
Draft ✏️ monitors/draft	Allow creating and editing draft monitors before they are published.

Data Sampling

Controls access to sampled data from monitored tables.

Permission	Description
Access 📖 monitors/data-sampling/access	Allow accessing sampled data from tables. Required to view sample data in the UI.
Download 📖 monitors/data-sampling/download	Allow downloading sampled data from tables.

Exceptions

Controls access to monitor exception management for tracking and commenting on breached rows.

Permission	Description
Access 📖 monitors/exceptions/access	Allow viewing monitor exception activity logs.
Edit ✏️ monitors/exceptions/edit	Allow editing monitor exceptions, including updating attributes and adding comments.

Dashboard

Controls access to dashboards for visualizing data + AI quality metrics and insights.

Permission	Description
Access 📖 dashboard/access	Allow viewing dashboards.
Edit ✏️ dashboard/edit	Allow creating and editing all dashboards in the account.
Edit Their Own ✏️ dashboard/edit-their-own	Allow creating and editing only dashboards the current user created. Those with dashboard/edit permission can also edit these dashboards.

Data Products

Controls access to data products for organizing and tracking related data + AI assets.

Permission	Description
Access 📖 data-products/access	Allow viewing data products.
Edit ✏️ data-products/edit	Allow creating and editing all data products in the account.
Edit Their Own ✏️ data-products/edit-their-own	Allow creating and editing only data products the current user created. Those with data-products/edit permission can also edit these data products.

Data Exports

Controls access to data exports for downloading reports and data.

Permission	Description
Access 📖 data-exports/access	Allow accessing and downloading data exports.

Alerts

Controls access to alerts for viewing and managing data + AI quality issues.

Permission	Description
Access 📖 alerts/access	Allow viewing alerts and their details.
Edit ✏️ alerts/edit	Allow editing alerts, including merging, splitting, and updating properties.
Update Status ✏️ alerts/update-status	Allow updating alert status (e.g., acknowledging, resolving) and providing feedback on anomaly detections.

Assets

Controls access to the assets catalog for exploring and managing asset metadata.

Permission	Description
Access 📖 assets/access	Allow viewing the assets catalog and asset metadata.
Edit ✏️ assets/edit	Allow editing asset metadata in the catalog.

Lineage

Controls access to data + AI lineage features for understanding and monitoring data + AI flows.

Permission	Description
Access 📖 lineage/access	Allow viewing lineage graphs and their metadata.
Edit ✏️ lineage/edit	Allow creating and editing lineage metadata (nodes, edges, etc.).

Performance

Controls access to performance analytics to support query and warehouse analysis and optimization.

Permission	Description
Access 📖 performance/access	Allow accessing the performance dashboard and query analytics.

Users

Controls non-admin access to other account users.

Permission	Description
List 📖 users/list	Allow listing users in the account for features like assignee selection and @mentions.

Settings

Controls access to account settings and configuration.

Permission	Description
Access 📖 settings/access	Top-level permission for viewing account settings. This is used where there is not a more specific permission for a given setting.
Edit ✏️ settings/edit	Top-level permission for editing account settings. This is used where there is not a more specific permission for a given setting.
List Iam Resources 📖 settings/list-iam-resources	Allow listing IAM resource and permission definitions. Required for managing users, authorization groups, or roles, since these operations need to display available permissions.
Set Account Name ✏️ settings/set-account-name	Allow changing the account display name.

User

Controls self-managed, user-specific settings and preferences.

Permission	Description
Subscribe Weekly Digest ✏️ settings/user/subscribe-weekly-digest	Allow subscribing to or unsubscribing from the weekly digest email notification.

Users

Controls management of user accounts, including invitations and user attributes.

Permission	Description
Access 📖 settings/users/access	Allow viewing authentication and authorization settings.
Edit ✏️ settings/users/edit	Allow managing users, authorization groups, SSO, and authorization provisioning (SCIM) settings.

Authorization Groups

Controls management of authorization groups and their membership, including auth provisioning (SCIM) settings.

Permission	Description
Access 📖 settings/authorization-groups/access	Allow viewing authorization groups and their members. Also required for user management, since group membership is displayed when managing users.
Edit ✏️ settings/authorization-groups/edit	Allow creating, editing, and deleting authorization groups.
Manage Owners ✏️ settings/authorization-groups/manage-owners	Allow managing members of the built-in Account Owners authorization group.
Manage Domains Managers ✏️ settings/authorization-groups/manage-domains-managers	Allow managing members of the built-in Domains Managers authorization group.

Roles

Controls management of custom account roles and their permission definitions.

Permission	Description
Access 📖 settings/roles/access	Allow viewing account roles and their permission definitions. Also required for managing authorization groups, since role assignment requires listing available roles.
Edit ✏️ settings/roles/edit	Allow creating, editing, and deleting custom account roles.

SSO

Controls access to single sign-on (SSO) configuration settings.

Permission	Description
Access 📖 settings/sso/access	Allow viewing SSO configuration settings.
Edit ✏️ settings/sso/edit	Allow configuring single sign-on (SSO) settings.

Agents

Controls access to agent management for data collection agents.

Permission	Description
Access 📖 settings/agents/access	Allow viewing agent details, logs, and reachability information.
Edit ✏️ settings/agents/edit	Allow creating, updating, deleting, and managing data collection agents.

Domains

Controls access to domain management for organizing data + AI assets.

Permission	Description
Access 📖 settings/domains/access	Allow viewing domain settings.
List 📖 settings/domains/list	Allow listing available domains.
View Detail 📖 settings/domains/view-detail	Allow viewing detailed domain information and their assets.
Edit ✏️ settings/domains/edit	Allow creating, editing, and deleting domains and related settings.

PII Filters

Controls access to PII (Personally Identifiable Information) filter management.

Permission	Description
List 📖 settings/pii-filters/list	Allow listing PII filters.
View Metrics 📖 settings/pii-filters/view-metrics	Allow viewing PII filter detection metrics.
Edit ✏️ settings/pii-filters/edit	Allow creating, editing, and deleting PII filters.

Integrations

Controls access to integrations settings.

Permission	Description
Access 📖 settings/integrations/access	Allow viewing integrations and their configurations.
Edit ✏️ settings/integrations/edit	Allow creating, editing, and deleting integrations.

Notifications

Controls access to notification settings, audiences, and channels.

Permission	Description
Access 📖 settings/notifications/access	Allow viewing notification settings, audiences, and channels.
Edit ✏️ settings/notifications/edit	Allow creating, editing, and deleting notification settings, audiences, and channels.

API

Controls access to API tokens and the API explorer.

Permission	Description
Access 📖 settings/api/access	Allow accessing API settings and the API explorer.
Edit ✏️ settings/api/edit	Allow managing personal API tokens.
Manage Tokens ✏️ settings/api/manage-tokens	Allow managing account-level service tokens and integration tokens.

Ingestion

Controls access to data ingestion settings and metrics for the account.

Permission	Description
Access 📖 settings/ingestion/access	Allow viewing data ingestion settings and metrics.
Edit ✏️ settings/ingestion/edit	Allow editing data ingestion settings.
Manage Collection ✏️ settings/ingestion/manage-collection	Allow managing data collection settings, including upgrades and collection preferences.

Secrets

Controls access to secrets management for storing sensitive credentials.

Permission	Description
Access 📖 settings/secrets/access	Allow viewing secrets (names/metadata only, not values). Use settings/secrets/view-values to view secret values.
Edit ✏️ settings/secrets/edit	Allow creating, editing, and deleting secrets.
View Values 📖 settings/secrets/view-values	Allow viewing secret values. This grants access to sensitive credential data.

Billing

Controls access to billing information and invoices.

Permission	Description
Access 📖 settings/billing/access	Allow viewing billing information and invoices.
Edit ✏️ settings/billing/edit	Allow modifying billing plan and contract settings.

Network

Controls network access control settings such as IP restrictions for data being pushed into our system via API, Integration Gateway, or other push-based services.

Permission	Description
Access 📖 settings/network/access	Allow viewing network access control settings.
Edit ✏️ settings/network/edit	Allow managing network access control settings.