You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: references/workspace/custom-roles.mdx
+18Lines changed: 18 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -103,6 +103,24 @@ Custom roles are assigned at the project level to provide granular access contro
103
103
104
104
## Scope reference
105
105
106
+
### Content-as-code scopes
107
+
108
+
Two scopes control access to [content as code](/guides/developer/dashboards-as-code), the CLI workflow for managing charts and dashboards as YAML files.
109
+
110
+
**Download content as code** (`view:ContentAsCode`) lets a user pull existing charts and dashboards as YAML via `lightdash download`. It does not allow pushing changes back.
111
+
112
+
**Download and upload content as code** (`manage:ContentAsCode`) grants both download and upload. Users with this scope can run `lightdash upload` to overwrite charts and dashboards in the project.
113
+
114
+
Use **download-only** to let a user pull production YAML for local development, diffing, or inspection without giving them the ability to overwrite production content. Combine with a controlled promotion path (e.g., CI/CD running with a service account that holds the manage scope) so writes only land via the pipeline.
115
+
116
+
For example, to protect a production project from accidental `lightdash upload` overwrites:
117
+
118
+
1. Downgrade the user's org role to **Member** or **Viewer** so they don't inherit `manage:ContentAsCode` from their org role.
119
+
2. Create a custom project role with only **Download content as code** enabled (plus whatever else they need).
120
+
3. Assign the custom role to the user on the production project.
121
+
122
+
The user can now run `lightdash download` against production but will get a `403` on `lightdash upload`.
123
+
106
124
### SQL-related scopes
107
125
108
126
Three scopes control different SQL-authoring features. They are independent — granting one does not grant the others.
0 commit comments