Permissions & Governance
Design role-based access, marking categories, and organization-level governance strategies that scale.
1 · Role-Based Access Control
Foundry uses project-level roles to control access: Viewer, Editor, Owner. These cascade down to all resources within a project. For more granular control, you can assign roles on individual resources.
Organisational groups make management scalable — assign a group to a project role, and all group members inherit the access. When someone leaves the team, removing them from the group revokes all their project access instantly.
2 · Markings and Data Classification
Markings are labels that classify data by sensitivity: "Public", "Internal", "Confidential", "Restricted". A marking is applied to a dataset (or even individual columns) and propagates — if a transform reads a "Confidential" input, its output is automatically marked "Confidential".
Users can only see data at or below their clearance level. This means governance is baked into the data lineage, not managed as a separate spreadsheet.
3 · Designing a Governance Strategy
At scale, governance requires planning:
- Define a marking taxonomy before data lands in Foundry.
- Use organisation-level defaults so new projects inherit sensible roles.
- Audit access regularly with Foundry's built-in access reports.
- Combine markings with purpose-based access — users explain why they need access, and approvals are tracked.
Good governance is invisible to end users but essential for trust.
✅ Key Takeaways
- Project roles (Viewer, Editor, Owner) control resource access.
- Groups make permission management scalable across teams.
- Markings classify data by sensitivity and propagate through lineage.
- A well-planned governance strategy is essential for enterprise-scale Foundry.