# Access Management Policies Overview


This guide introduces the concept of an access policy in RudderStack's Access Management system.

## Overview 

An access policy is a bundle of configured permissions. The process of configuring an access policy is the same for a [Baseline Workspace Policy]({{< ref "access-management/baseline-workspace-policy.md" >}}), [Group Policies]({{< ref "access-management/groups.md" >}}), [Member Policies]({{< ref "access-management/members.md" >}}), and [Access Tokens]({{< ref "access-management/service-access-tokens.md" >}}). 

The permissions within an access policy are organized into two broad categories:

- [Resource permissions](#resource-permissions)
- [PII permissions](#pii-permissions)

## Resource permissions

The **Resources** section lets you configure permissions for all RudderStack resources. These include:

- Event Stream [Sources]({{< ref "sources/event-streams/" >}}) and [Destinations]({{< ref "destinations/streaming-destinations/" >}})
- [Reverse ETL Sources]({{< ref "sources/reverse-etl/" >}}) created via tables, SQL models, and Audiences
- [Transformations]({{< ref "transformations/overview.md" >}}) and [Transformation Libraries]({{< ref "transformations/libraries.md" >}})
- [Tracking Plans]({{< ref "data-governance/tracking-plans/" >}}) and [Data Catalog]({{< ref "data-governance/data-catalog/" >}})
- [Profiles]({{< ref "profiles/overview/" >}})
- Ability to override [Alerts]({{< ref "monitor/alerts.md" >}}) and retry warehouse syncs (for both sources and destinations).
- [Bot management]({{< ref "data-governance/bot-management.md" >}}) and the ability to manage [Credentials]({{< ref "transformations/credentials.md" >}}) to securely store sensitive keys and secrets for use in transformations.

{{< info >}}
For many resources, you can configure permissions at a [resource level](#set-granular-resource-and-pii-permissions), meaning you can choose a subset of resources to which the permission applies.
{{< /info >}}

A sample resource permissions policy configuration for a workspace is shown below:

{{< image src="images/access-management/resource-permissions.webp" alt="Resource permissions" >}}

### Edit, Connect, and Create & Delete permissions

You can assign **Edit**, **Connect**, and **Create & Delete** permissions to resources.

| Permission | <div style="width:350px">Description</div> | 
| :----| :-----| 
| Edit |  Make changes to the configuration of resources.  | 
| Connect | Connect two resources. | 
| Create & Delete | Create or delete resources for a resource type. | 

### Permissions dependencies

Depending on the type of resource, some permissions have dependencies across resources. The table below provides details on dependencies. 

| Resource | Permission | <div style="width:250px">Dependencies</div> |
| :----| :-----| :----|
| <ul><li>Sources</li><li>Destinations</li><li>Transformations</li><li>Tracking Plans</li><li>Tables</li><li>Audiences</li><li>SQL Models</li></ul> |  **Connect**  | **Edit** and **Connect** permissions are required on **both** resources (source and destination, transformation and destination, source and Tracking Plan, etc.) to make a successful connection |
| Data Catalog | **Edit** events and properties that are part of a Tracking Plan | **Edit** permission for that Tracking Plan |

## PII permissions

{{< announcement >}}
The configurable PII permissions feature is available in the [Enterprise](https://www.rudderstack.com/enterprise-quote/) plan only.
{{< /announcement >}}

The **PII** section lets you configure permissions for viewing parts of the platform where payloads might contain PII. These include: 

- Live events from Event Stream pipelines (Sources, Destinations, and Transformations)
- Live events from Reverse ETL sources (created via tables, SQL models, or Audiences)
- [Sample events]({{< ref "dashboard-guides/data-management.md#sample-event-data" >}}) that include:

    - Destination delivery failures
    - Transformation errors
    - Tracking Plan violations

### Configurable permissions

The following table lists all the configurable PII permissions:

| PII permission | <div style="width:350px">Description</div> |
| :----| :-----|
| Destination Live Events | View [live events]({{< ref "monitor/live-events.md#destination-live-events" >}}) for a destination |
| Destination Failure Samples | View [failure samples]({{< ref "dashboard-guides/event-metrics/destinations.md#view-failed-event-details" >}}) for a destination |
| Destination Data Access | Access data from the [Activation API]({{< ref "profiles/dev-docs/activation-api/" >}}) |
| Event Stream Source Live Events | View [live events]({{< ref "monitor/live-events.md#source-live-events" >}}) ingested by an Event Stream source |
| Table Live Events | View live events from a Reverse ETL source created via a warehouse table |
| Audience Live Events | View live events from a Reverse ETL source created via an [Audience]({{< ref "data-pipelines/reverse-etl/features/audiences.md" >}}) |
| SQL Model Live Events | View live events from a Reverse ETL source created via a [SQL Model]({{< ref "data-pipelines/reverse-etl/features/models.md" >}}) |
| Reverse ETL Sync Failure Samples | View failure samples for a Reverse ETL sync |
| Transformation Live Events | View [live events]({{< ref "monitor/live-events.md#transformation-live-events" >}}) flowing through a transformation |
| Transformation Failure Samples | View [failure samples]({{< ref "dashboard-guides/event-metrics/transformations.md#view-transformation-error-details" >}}) for a transformation |
| Tracking Plan Violations | View [Tracking Plan violations]({{< ref "data-governance/tracking-plans/violation-management.md" >}}) |

{{< info>}}
**PII permissions for transformations connected to destinations**

If you connect a transformation to a destination, you will see [transformation failures]({{< ref "dashboard-guides/event-metrics/transformations.md#view-transformation-error-details" >}}) (which are a part of that pipeline) along with other [event failure metrics]({{< ref "dashboard-guides/event-metrics/destinations.md#view-failed-event-details" >}}) in the destination's **Events** tab and [Health dashboard]({{< ref "monitor/health-dashboard.md#get-failure-metrics" >}}).

In this case, you need only the **Destination Failure Samples** PII permission for the specific destination — the **Transformation Failure Samples** PII permission is not required.
{{< /info >}}

A sample PII policy configuration as a part of the [Baseline Workspace Policy]({{< ref "access-management/baseline-workspace-policy.md" >}}) is shown below:

{{< image src="images/access-management/example-pii-permissions.webp" alt="PII permissions for a workspace" >}}

## Granular resource and PII permissions

{{< success >}}
The granular resource and PII restrictions apply across both the RudderStack dashboard and API layers, ensuring comprehensive privacy control.
{{< /success >}}

You can configure **Edit** and PII permissions for specific resources within your workspace. To grant **Edit** permission for a subset of Event Stream sources, click the dropdown next to **Event Streams** and select the sources. 

{{< image src="images/access-management/specific-edit-permissions.webp" alt="Edit permissions example" >}}

Similarly, you can grant PII access to [Live Events]({{< ref "monitor/live-events.md" >}}) for a subset of sources:

{{< image src="images/access-management/specific-pii-permissions.webp" alt="PII permissions given to specific resources" >}}

### Example

Suppose a workspace has three Event Stream sources (`S1`, `S2`, and `S3`) and three destinations (`D1`, `D2`, and `D3`). You can configure the [Baseline Workspace Policy]({{< ref "access-management/baseline-workspace-policy.md" >}}) to grant:

- **Edit** permission only for sources `S1` and `S2` 
- **Edit** permission only for destinations `D1` and `D2` 
- **Connect** permission for sources
- **Connect** permission for destinations
- PII permission to view live events only for source `S1`

The baseline access policy then looks as follows:

{{< image src="images/access-management/granular-resource-permissions-example.webp" alt="Resource permissions example" >}}

{{< image src="images/access-management/granular-pii-permissions-example.webp" alt="PII permissions example" >}}

#### What the member can do

A member inheriting the above baseline policy **will** be able to:

- Edit only sources `S1` and `S2`
- Edit only destinations `D1` and `D2`
- Connect sources `S1` and `S2` to destinations `D1` and `D2`
- View Live Events for source `S1`

#### What the member cannot do

The member **will not** be able to:

- Edit source `S3`
- Edit destination `D3`
- Make any connections to source `S3`
- Make any connections to destination `D3`
- View Live Events for sources `S2` and `S3`
- View Live Events or failure samples for destinations `D1`, `D2`, and `D3`

Members without the above granular permissions will see greyed-out UI elements with explanatory tooltips, as shown below:

**Without resource permissions**

{{< image src="images/access-management/no-permissions.webp" alt="User without resource permissions" >}}

**Without PII permissions**

{{< image src="images/access-management/no-pii-permissions.webp" alt="User without PII permissions" >}}

### Plan-wise limits

See the [Plan-wise Features]({{< ref "access-management/plan-wise-features.md#granular-resource-permissions" >}}) guide for more details on granular resource and PII permission limits across different RudderStack plans.