Manage resource access

Open a semantic layer’s Access tab, or a data connection’s Manage Access tab, to choose who can use it. You need permission to manage access for that resource. You can manage access without permission to edit the resource itself.

Choose a profile

With explicit resource access enabled for your workspace, add a person, group, workspace role or Everyone, then choose a profile:

Profile	Permissions
View	View the resource
Edit	View and edit the resource
Full access	View, edit, delete and manage access

Data connections also offer Create, which grants View and Create semantic layers without editing the connection, deleting it or managing access. Edit and Full access also allow creating semantic layers. New grants start with View. Everyone grants apply across your workspace.

Everyone, Viewer and Designer roles, and people whose workspace role is not Owner, Administrator or Creator can only be assigned View. Groups and Creator roles can use the other profiles. Existing higher permissions remain visible after a role change. You can reduce those grants to View or remove them; opening the panel does not change them.

For principals eligible for higher permissions, select Custom to change permissions individually beneath the profile buttons. Opening Custom does not change your grant. It stays open while you adjust permissions, even if they match a profile. A combination that does not exactly match a profile displays Custom. Choosing a profile replaces that grant’s individual permission selection. Clearing all permissions removes the grant when you select Update.

Changes take effect when you select Update. Cancel lets you discard unsaved changes. If an update fails, your draft remains available to correct or retry.

Understand who retains access

The panel lists direct grants. Removing a person’s grant does not remove access they receive through a group, workspace role or Everyone. Workspace owners and administrators always have full access; you cannot remove that access here.

Creating a semantic layer or data connection does not make access permanent. A creator’s explicit grant can be changed or removed according to their current workspace role. You cannot add, change or remove your own direct grant, even when you can manage access. Another access manager must change it for you.

Workspaces still using legacy resource access allow resource editors to manage access and retain fixed creator access. With explicit resource access enabled, Edit and Manage access are independent. Semantic layers show View/Edit controls. Data connections also offer Create and custom combinations of View, Edit and Create semantic layers; Delete and Manage access are not separate options in legacy mode. Workbook and collection access continue to use their existing rules.