Access Control
Every resource on the platform — a project, a dataset, an analysis — has two settings that determine who can see it and what they can do with it:
- An access mode, which decides who can reach the resource.
- A role, which decides what a person who reaches it is allowed to do.
Access Modes
Each resource has a single access mode at any given time. There are four:
| Mode | Who can access |
|---|---|
| Restricted | Only the owner and people or organizations the owner has explicitly granted access to. |
| Organization | The owner, explicitly-granted users, and everyone in the organization that owns the resource. |
| Public | Any signed-in user on this server. |
| Anonymous | Anyone, with no sign-in required. |
When to Use Each Mode
- Restricted — sensitive work-in-progress, contractual data, anything where the default should be “no, unless I add you.” Use this when you are not yet ready for the rest of your team to see what you are building.
- Organization — the everyday collaboration mode. Anyone on your team can see it without you having to invite them one by one. This is also the default for newly created resources.
- Public — internal showcases, reference material, or shared resources that any user of the server should be able to read. People still need an account, but you don’t need to manage who they are.
- Anonymous — public read-only datasets, demo content, embeddable views, and anything you want to share with people who don’t have accounts. Treat anything in this mode as published to the open internet.
Roles
When someone has access to a resource, the role determines what they can do:
| Role | Permissions |
|---|---|
| Viewer | Read the resource. Cannot change anything. |
| Editor | Read and write the resource — edit content, metadata, and settings. |
The user who created a resource is its owner. Owners always have full control regardless of any role assignment, including the ability to change the access mode and to grant or revoke access for others.
Default on Create
When you create a new project, it is set to:
- Access mode: Organization
- Role for your organization: Editor
This means anyone in your organization can immediately open and contribute to the project. If you need a stricter setup, change the access mode to Restricted before sharing the link or inviting others.
If you belong to more than one organization, you choose which org owns the new project at the moment of creation.
Examples
Solo work in progress. You are exploring a new dataset and don’t want anyone to see it until you decide what to do with it. Create the project, then change the access mode to Restricted.
Team collaboration. You are working on a shared analysis with your colleagues. Leave the access mode at the default (Organization); everyone on your team is already an Editor.
Read-only sharing with another team. Your project is in Restricted mode. You want a partner organization to be able to look but not modify. Grant that organization access with the Viewer role.
Public demo. You want to share an interactive demo at a conference, including with attendees who don’t have accounts. Switch the project to Anonymous access.