Console roles and permissions
Organization roles
Refer to Manage cloud users for instructions on assigning organization roles.
ClickHouse has four organization level roles available for user management. Only the admin role has default access to services. All other roles must be combined with service level roles to interact with services.
| Role | Description |
|---|---|
| Admin | Perform all administrative activities for an organization and control all settings. This role is assigned to the first user in the organization by default and automatically has Service Admin permissions on all services. |
| Developer | View access to the organization and ability to generate API keys with the same or lower permissions. |
| Billing | View usage and invoices, and manage payment methods. |
| Member | Sign-in only with the ability to manage personal profile settings. Assigned to SAML SSO users by default. |
Service roles
Refer to Manage cloud users for instructions on assigning service roles.
Service permissions must be explicitly granted by an admin to users with roles other than admin. Service Admin is pre-configured with SQL console admin access, but may be modified to reduce or remove permissions.
| Role | Description |
|---|---|
| Service read only | View services and settings. |
| Service admin | Manage service settings. |
SQL console roles
Refer to Manage SQL console role assignments for instructions on assigning SQL console roles.
| Role | Description |
|---|---|
| SQL console read only | Read only access to databases within the service. |
| SQL console admin | Administrative access to databases within the service equivalent to the Default database role. |
