Admin settings - Roles

Roles, permission sets, and model sets are used together to manage what users can do and what they can see. The Roles page in the Users section of the Admin panel lets you view, configure, and assign roles, permission sets, and model sets.

You can search for specific roles, permission sets, and model sets by entering a search term into the search box in the upper right and pressing Enter.

Definitions

• A role defines the privileges that a user or group will have for a specific set of models in Looker. You create a role by combining one permission set with one model set.
• A permission set defines what a user or group can do. You select a combination of permissions that you want to assign to a user or group. It must be used as part of a role to have any effect.
• A model set defines what data and LookML fields a user or group can see. You select a combination of LookML models to which a user or group should have access. It must be used as part of a role to have any effect.

Managing roles

A role is a combination of one permission set and one model set. It's a common convention to name roles after types of people or groups of people in your organization — administrator, Looker developer, Finance team — although you can certainly follow your own naming conventions.

A user can have more than one role in Looker. This can be useful when you have users who play multiple roles in your company or when you want to create complex systems of access to your models.

Creating, editing, and deleting roles

To create a role, follow these steps:

1. Click the Add Role button at the top of the Roles page.

2. Looker displays the New Role page, where you can configure the following settings:

   • Name: Enter a name for the role.
   • Permission Set: Choose a permission set to associate with the role.
   • Model Set: Choose a model set to associate with the role.
   • Groups: Optionally, choose one or more groups to assign the role to.
   • Users: Optionally, choose one or more users to assign the role to.

3. Once you've configured the role as intended, click the New Role button at the bottom of the page.

After a role has been created, you can edit it by clicking the three-dot Options menu to the right of the role on the Roles page, and selecting Edit. Selecting Edit takes you to the Edit Role page for that role, where you can edit the name, the permission set, the model set, and the groups or users who are assigned to the role.

To delete a role, click the three-dot Options menu to the right of the role on the Roles page, and select Delete.

Default roles

For new instances, Looker creates the following default roles, each of which includes a default permission set of the same name:

• Admin
• Admin via IAM
• Developer
• Gemini
• Looker CI Users
• Conversational Analytics Agent Manager
• Conversational Analytics User
• Conversational Analytics Viewer
• Support Advanced Editor
• Support Basic Editor
• Customer Engineer Advanced Editor
• User
• Viewer

The default roles in the following sections have conditions for use.

Admin via IAM

The Admin via IAM role is available only in Looker (Google Cloud core), and it can be managed only through the Google Cloud console. For more information, see the Authentication and authorization with OAuth and IAM and Admin Looker role versus the Admin via IAM Looker role documentation.

The Admin via IAM role uses the Admin permission set.

Looker CI Users

The Looker CI Users role is created automatically for Looker instances that have been enabled for Continuous Integration. The Looker CI Users role is applied to the Looker CI service accounts that can be viewed in the Service Accounts tab of the Users Admin page. Looker uses these CI service accounts to perform CI runs on the instance.

The Looker CI Users role has the following permissions that are required to perform CI runs:

• deploy: required for setting up the GitHub webhooks that are required for CI runs
• see_ci: required to view the results of CI runs, view the CI Suites page, and run CI suites
• manage_ci: required to create CI suites, manage CI users, and configure the Git connection with Continuous Integration

Gemini

The Gemini role cannot be renamed or deleted. By default, this role's permission set applies to all models on the Looker instance. Gemini permission set that is included in this role enables users to perform the following tasks in the Looker instance with Gemini assistance when they also have other required permissions:

• Write LookML — when they also have a Looker role that contains the develop permission for at least one model in a LookML project.
• Create custom Looker visualizations — when they also have a Looker role that contains the can_override_vis_config permission.
• Directly query Looker Explore data or chat with a data agent that queries Explore data with Conversational Analytics, even if the user hasn't been assigned explore permissions in Looker, when they also have a Looker role that contains additional required permissions.

Additional permissions are required to use Conversational Analytics, which can be granted with either the Conversational Analytics Agent Manager or the Conversational Analytics User role.

For more information about Gemini in Looker features, see the Gemini in Looker overview.

Conversational Analytics Agent Manager

The Conversational Analytics Agent Manager role consists of the Conversational Analytics Agent Manager permission set for all models that are on the Looker instance. Users with this role can create, edit, share, and delete Conversational Analytics data agents that use Looker Explores.

Conversational Analytics User

The Conversational Analytics User role consists of the Conversational Analytics User permission set for all models on the Looker instance. Users with this role can chat with any Conversational Analytics data agent in Looker, as long as they have been granted View access to the data agent.

Conversational Analytics Viewer Added 26.12

The Conversational Analytics Viewer role consists of the Conversational Analytics Viewer permission set for all models on the Looker instance. Users with this role can chat with any Conversational Analytics data agent in Looker, as long as they have been granted View access to the data agent and the access_data permission on the appropriate models.

Support Advanced Editor and Support Basic Editor

These roles won't appear on a Looker (original) instance if a Looker admin has disabled the Tiered Support Access Labs feature. These roles won't appear on a Looker (Google Cloud core) instance if the instance uses private connections (private services access or Private Service Connect) networking or hybrid connections networking.

The Support Advanced Editor and Support Basic Editor roles cannot be edited, deleted, or assigned to users other than support access users.

Assigning default roles to a user

To update an individual user's settings to assign a default role, follow these steps:

1. Navigate to the Users page in the Users section of the Admin panel.
2. Select the user or group whose permissions you want to change.
3. From the Roles drop-down menu, select the role name.
4. Select Save to retain these settings.

Permission sets

A permission set defines what a user or group can do. Admins can use Looker's default permission sets or create original permission sets, keeping in mind permission dependencies.

All the available permissions, and their types, are discussed in more detail in the permissions list.

Default permission sets

For new installations, Looker includes several default permission sets that you can start with:

You'll see these permission sets appear as options when you create a new role. If you select one of these permission sets, Looker will display the list of permissions that it includes.

Creating permission sets

To create a permission set, click the Add Permission Set button at the top of the Roles page. Looker will display a page where you can enter a name for the permission set and select the permissions that it should include. Once you've configured the set as needed, click the New Permission Set button at the bottom of the page.

After a permission set has been created, you can edit or delete it by clicking the three-dot Options menu to the right of the permission set on the Roles page, and selecting Edit or Delete.

Permissions and dependencies

Some permissions depend on others to work properly. For example, it makes sense that someone who wants to develop in LookML must first be able to see LookML.

When you create a permission set, you'll see the available permissions in an indented list. If a privilege is indented under another (parent) privilege, you must select the parent privilege first. The permission list may look like this:

☑️ access_data
  ☑️ see_lookml_dashboards
  ☑️ see_looks
    ☑️ see_user_dashboards

In this example, Looker uses indentation to indicate the following:

• The access_data privilege can be selected at any time.
• The see_lookml_dashboards and see_looks privileges require the access_data privilege to be selected first.
• The see_user_dashboards privilege depends on the