Example: only allow Query Runner operations

Let's consider this scenario:

1. You are a Polytomic Admin.
2. You would like to define a role with no ability to perform any operations in Polytomic except for running queries in Query Runner against your data warehouse:

This tutorial will define a custom role and policy to cover this use case. Throughout the steps below, ensure that your role is Admin:

1. Go to Roles and create a role with your chosen name (for example: Query-only role):

2. Now that we created a role, we will create a custom security policy. Go to Access control and click Create policy:

3. Give your policy a name (for example: Query Runner policy).

4. Map its operations to these corresponding roles:

apply_policy: Admin

create: Can leave blank.

delete: Can leave blank.

edit: Can leave blank.

export: Query-only role

modify_policy: Admin

query: Query-only role

sync_to: Can leave blank.

trigger: Can leave blank.

5. Attach this policy to your data warehouse connection (for example, Databricks):

Per the steps above, any user with only the Query-only role will be excluded from performing any operations in Polytomic except for running queries in Query Runner and seeing their results.

🚧

The query action does not limit users to read-only queries

The query action controls whether a role may query a connection, not what kind of SQL it may run. Query Runner executes statements using the credentials configured on the connection, so a user holding only the Query-only role can still modify data if those credentials permit writes. To make this role read-only in practice, attach the policy to a connection whose credentials grant read access only.