Regarding dataset related ownership & permission

[Dhruvin4530]

@dosu
I want the following: Is it possible to achieve this in Superset?

1. If team A creates the datasets, then only team A can edit them; no other team should be able to edit them.
2. All other teams should be able to use those datasets to create the charts and dashboards.

[dosubot[bot]]

Yes, this is achievable in Superset using its ownership model and object-scoped permissions. Superset separates edit access from use/query access into two independent dimensions:

1. Restricting edits to Team A only:

• Add Team A members as owners of the datasets they create. Admins and owners bypass access checks and can edit the dataset [1].
• Ensure Team A's role includes can_write on the Dataset resource, which is the FAB permission governing dataset CRUD operations (create, edit, delete) [2].
• Do not add members of other teams as dataset owners. Without ownership (and without Admin role), they will not be able to edit those datasets.

2. Allowing other teams to use the datasets for charts/dashboards:

• Each dataset automatically gets an object-specific datasource_access permission (e.g., [my_database].[my_table](id:123)) when it is created [3].
• Create a custom role for the other teams and grant the relevant datasource_access permissions for the datasets they need to consume [4]. This gives them query/read access without edit rights.
• Alternatively, granting all_datasource_access or database_access / schema_access at a broader scope will let them use all datasets under that database or schema.

In short: make Team A the owners with can_write on Dataset, and give other teams only datasource_access on the specific datasets (or broader database/schema access). The two permission types are independent — having datasource_access does not grant edit ability [3].

Note that datasource_access permissions are never assigned to built-in roles (Admin/Alpha/Gamma) automatically — they must be managed through custom roles [4].

Would you like more detail on how to set up the custom roles or assign datasource_access permissions in practice?

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[Dhruvin4530]

@dosu I want an automated way. Let's say if team A creates a dataset, then they are the owner. I don't want to do anything manually after this. In the future, if team B creates the dataset, then they are the owner. I don't want any manual steps.

[dosubot[bot]]

Good news — the first part is already automatic. When any user creates a dataset through the Superset UI or API, they are automatically added as an owner with no manual steps required. This is handled in the command layer's populate_owner_list logic: if the owners field is empty or omitted, the current user becomes the sole owner [1]. So if a Team A member creates a dataset, they're the owner; if a Team B member creates one, they're the owner. No manual intervention needed.

For the second part — allowing other teams to use those datasets without being able to edit them — there's no per-dataset automation built in, but you can achieve it automatically at a broader scope:

Recommended approach: Use database or schema-level permissions.
Instead of granting datasource_access on each individual dataset, grant the consuming teams' roles access at the database or schema level [2]. This means any new dataset created under that database/schema is automatically accessible to those teams for building charts and dashboards, with zero manual steps after initial role setup.

Here's how to set it up once:

1. Create a custom role (e.g., team_b_consumers) for the consuming team.
2. Grant that role database_access on the relevant database — or schema_access for finer control — plus can_read on Chart/Dashboard resources and other read-level permissions they need.
3. Do not grant can_write on Dataset to this role, and do not add these users as dataset owners.

With this setup:

• Creators automatically become owners and can edit their own datasets [3].
• Non-owners with database/schema access can query and use the datasets for charts/dashboards but cannot edit them, since editing requires ownership (or Admin role) [2].
• New datasets created under that database/schema are automatically covered — no per-dataset permission grants needed.

This is the most hands-off approach available natively. Would you like help with the specific permission list to include in the consumer role?

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[Dhruvin4530]

@dosu So the 2nd step is manual and everytime if any team creates the dataset, we will have to follow the same process?

[dosubot[bot]]

Not quite — the setup I described is a one-time configuration, not something you repeat per dataset.

Here's the distinction:

• One-time setup (done once): Create the consumer role (e.g., team_b_consumers), grant it database_access or schema_access on the relevant database/schema, and assign the consuming team's users to that role. This is the only manual step.

• After that, it's fully automatic: Any new dataset created by any team under that database/schema is automatically accessible to all teams that hold the database/schema-level permission. No per-dataset action is needed. The creator automatically becomes the owner (and can edit), while everyone else with the database/schema role can use it but not edit it.

The only scenario where you'd need to repeat any manual steps is if you add an entirely new database or schema to Superset — in that case you'd need to grant the consumer role access to that new database/schema once. But for datasets within already-configured databases/schemas, everything flows automatically.

So to summarize: one-time role setup per database/schema → all future datasets under it are automatically covered for both ownership (edit) and consumption (read/use).

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.