Understanding user permissions for packages
Package access decides who can see a package, who can change one, and who can put one into production. This article describes the three privilege levels, where a grant can sit, and what each action requires.
The three privilege levels
| Level | In short |
|---|---|
| Viewer | Read. See the list, open a package, and read its definition. |
| Contributor | Change. Edit fields, save, and run. |
| Administrator | Create and destroy. Everything above, plus create, publish, duplicate and delete. |
The levels are ordered, so Contributor includes everything Viewer can do.
Where a grant can sit
A grant on a Packages node applies to every package in that workspace. Grants on a workspace, or on the Workspaces group above it, flow down the same way.
A grant can also sit on one individual package. That is how you give somebody Contributor access on a single package without giving them the whole workspace.
The two routes are not interchangeable: some actions accept an object-level grant, and some require a workspace-level one.
What each action needs
| Action | Minimum level | Is a grant on one package enough? |
|---|---|---|
| See the Packages list | Viewer | Yes. A grant on one package is enough to see the list. |
| Open a package | Viewer | Yes |
| Edit its fields | Contributor | Yes |
| Save | Contributor | Yes |
| Run | Contributor | Yes |
| Publish | Administrator | Yes |
| Create | Administrator | No. Workspace level only. |
| Duplicate | Administrator | No. Workspace level only. |
| Delete | Administrator | No. Workspace level only. |
| Grant package access to someone else | Global administrator | Not applicable |
Two consequences are worth spelling out:
- Creating needs the workspace, not a package. A package that does not exist yet cannot carry a grant. Duplicate is a create, so it follows the same rule.
- Publish and Delete are both Administrator actions, but they differ on scope. Someone with Administrator access on a single package can publish that package. Deleting it requires Administrator access on the workspace.
Related articles
- Manage users and roles in TimeXtender Data Platform
- Use Entra groups for roles
- Packages in TimeXtender Data Platform
- Understanding schedule permissions
