UPDATED IN VERSION 6.1
KDQ Agentic uses a two-level access model: one platform-level role, plus workspace roles you assign per workspace. A user can hold a different workspace role in each workspace they belong to (for example, Workspace Admin in Finance and Viewer in Engineering). Configuring the right access lets each team operate its own workspace independently, while protecting source connections, rule configurations, and results from unintended changes.
KDQ Access Roles
There are three workspace roles. Each one includes everything the role below it can do:
|
Role |
Permissions |
|
|---|---|---|
|
Viewer |
Can view sources, tables, profiles, rules, run history, schedule groups, members, and workspace settings. Cannot create, edit, run, or delete anything. |
|
|
Rule Creator |
Everything a Viewer can do, plus authoring and testing DQ rules: write rules in plain English or manual SQL, run AI-assisted rule generation, profile tables, and manage draft rules (edit, bulk actions, assign to schedule groups, run a schedule group now). Cannot create or manage data sources, or manage members and workspace settings. |
|
|
Workspace Admin |
Full control of a workspace. Everything a Rule Creator can do, plus create, edit, and delete source connections, import tables from a source, manage source-level catalog links, create/edit/delete schedule groups, manage members, and edit workspace settings. |
|
In addition to Workspace-level roles, there is a platform-wide KDQ Platform Admin role:
|
Role |
Permissions |
|---|---|
|
KDQ Platform Admin |
Can create, archive, and restore workspaces; invite platform users and grant or revoke platform-admin status; view SMTP/alerts configuration and send a test alert; run the cross-workspace catalog export. A Platform Admin also acts as a Workspace Admin inside any workspace they open, but still has to open a workspace to see its data — there's no single cross-workspace view. |
Adding Members to a Workspace
🔒 Only Workspace Admins and KDQ Platform Admins can manage Workspace membership.
-
Open the relevant workspace and go to Settings → Members.
-
Click Add Member.
-
Search for the user by name or email. They need an existing K platform account first — if they don't appear, add them to K first (see Configuring users in K).
-
Select their role: Viewer, Rule Creator, or Workspace Admin.
-
Click Add. They'll be notified they've been granted access.
Changing a Member's Role
-
Go to Settings → Members in the workspace.
-
Find the user in the members list.
-
Click the role dropdown next to their name and select the new role.
-
The change takes effect immediately.
Removing a Member
-
Navigate to Settings → Members
-
Click the … menu next to the user's name
-
Select Remove from Workspace
-
Confirm the removal
⚠️ Removing a member does not delete any checks or results they created. Their contributions remain in the Workspace.
Recommended Access Patterns
|
Scenario |
Recommended setup |
|---|---|
|
Domain teams authoring and running their own rules |
Each domain team has at least one Workspace Admin and several Rule Creators in their workspace |
|
Governance team needs read-only visibility across workspaces |
Add governance users as Viewers across the relevant workspaces |
|
Centralised DQ team managing all rules |
Single workspace with the DQ team as Rule Creators/Workspace Admins; data owners added as Viewers |
|
Sensitive data domain requiring restricted access |
Create a dedicated workspace and limit membership to approved team members only |
Workspace Access vs K Platform Access
KDQ Workspace access is separate from K platform roles. A user needs both:
-
A K platform account with an appropriate role (see K User Roles) to view DQ results on Data Profile Pages in K
-
KDQ Agentic workspace membership to access, manage, or author rules directly within KDQ Agentic
Data consumers who only need to see DQ results in K don't need KDQ Agentic workspace access — a standard K platform account is enough.
Single Sign-On
KDQ Agentic uses OpenID Connect for authentication. Workspace access and roles are still managed inside KDQ Agentic itself; SSO only controls who can log in. See Setting up SSO for KDQ Agentic for configuring your identity provider.
💡 Tip: If your organisation uses teams in K, consider aligning KDQ Workspace membership to the same team structure. This makes it easier to manage access as your organisation grows and teams change.