Managing Access

Overview

This document outlines the access control policies and procedures for the WUSM Data Lake. It provides guidance on managing user accounts, roles, and permissions to ensure secure and efficient access to data assets.

Team Groups

• Add volumes for team instead of storage accounts.
• Create in-database accounts and add users to the group we create.
• Attach the team to the workspace.

Roles

• _unrestricted: Full access to everything (schema level).
• _restricted: Access limited to views from tables with PHI or non-PHI (table level).
• _stewards: Full access to everything, including the ability to add tags.

Sensitivity Levels

• Under Review: Skip access for restricted roles.
• PHI: Mask fields or pass them to the view creator for handling.
• Non-PHI: Drop views for tables marked as PHI but without columns to mask.

Datasource Groups

Permissions granted to assets:

• Unrestricted: Full access.
• Restricted: Limited access based on sensitivity levels.