Roles & Permissions

Understanding user roles and permissions in Cube.

Cube has four built-in default roles: Admin, Developer, Explorer, and Viewer. Each role has specific permissions and access levels designed to support different responsibilities within the platform.

The Enterprise tier allows creation of custom roles with a customized set of permissions tailored to your organization’s specific needs.

Permissions matrix

Permission	Admin	Developer	Explorer	Viewer
Manage users and account settings	✅	❌	❌	❌
Manage deployments and their settings	✅	✅	❌	❌
Edit semantic model	✅	✅	❌	❌
Execute SQL queries against data sources	✅	✅	❌	❌
Explore and query semantic models	✅	✅	✅	❌
Create and edit workbooks	✅	✅	✅	❌
View published dashboards	✅	✅	✅	✅
Export data from dashboards (CSV, PDF, PNG)	✅	✅	✅	✅
Access Analytics Chat	✅	✅	✅	✅
Query from external tools (Tableau, Power BI)	✅	✅	✅	✅

Admin roles are billed at the developer rate.

Restricting data downloads

By default, all roles can download query results as CSV from workbooks, Analytics Chat, and published dashboards. Two controls restrict this:

• Account-wide — the Allow data downloads switch on the Admin → Settings page. Turning it off hides export controls everywhere, for all users — including admins and embeds.
• Per user — the Download data action in custom roles. Built-in roles grant it by default; to remove download access for a group of users, assign them a custom role without it. Admins and anonymous embed viewers bypass it.

The account-wide switch always wins; the permission applies only while downloads are allowed account-wide. Both govern the download button, not data access — query results are still rendered on screen.

Agent Permissions

Agents are connected to Semantic Model Deployments and inherit the permission level of the user they are operating under.

Each agent can be configured to use the Restrict Views feature which allows to select the views that are visible to the agent. This feature should not be used as a security measure. Configure access policies instead.

Typical Usage Scenarios

• Viewers: Business users who consume published dashboards, use Analytics Chat, and query data through external tools like Tableau or Power BI
• Explorers: Typically data consumers and analysts
• Developers: Usually data stewards and data engineers
• Admins: Typically assigned to data engineers managing the entire Cube instance (billed at the developer rate with additional privileges)