Roles
A role is a named bundle of permissions that you assign to a user. Roles are how you grant access in Matia: rather than picking individual capabilities, you give a teammate one or more roles, and each role determines what they can see and do.
Assign roles when you invite or edit a user. A user can hold multiple roles at once — their effective access is the combination of every permission across all of them.
How roles are built
Every role combines an access level with a scope.
Access level — how much a role can do — follows a consistent pattern that builds up in three steps:
| Level | What it can do |
|---|---|
| Viewer | Read-only. Browse resources and view issues, but make no changes. |
| Editor | Everything a Viewer can, plus create, edit, trigger, and enable/disable resources, and manage issues. |
| Admin | Everything an Editor can, plus delete resources and manage notification rules. |
Scope — where a role applies:
- Global roles apply across the entire platform — Integrations, Observability, and Catalog together.
- Area-specific roles apply to a single product area: Integrations, Observability, or Catalog.
So Integrations Editor = Editor access, Integrations only, while Global Admin = Admin access, everywhere. Mix and match to fit each person — for example, a data engineer might hold Integrations Admin plus Observability Editor.
Role comparison
| Role | Scope | View | Create & edit | Delete | Manage notification rules |
|---|---|---|---|---|---|
| Global Admin | All areas | ✓ | ✓ | ✓ | ✓ |
| Global Editor | All areas | ✓ | ✓ | ✓ | |
| Global Viewer | All areas | ✓ | |||
| Integrations Admin | Integrations | ✓ | ✓ | ✓ | ✓ |
| Integrations Editor | Integrations | ✓ | ✓ | ✓ | |
| Integrations Viewer | Integrations | ✓ | |||
| Observability Admin | Observability | ✓ | ✓ | ✓ | ✓ |
| Observability Editor | Observability | ✓ | ✓ | ||
| Observability Viewer | Observability | ✓ | |||
| Catalog Admin | Catalog | ✓ | ✓ | ✓ | ✓ |
| Catalog Editor | Catalog | ✓ | ✓ | ✓ |
Only Global Admin can invite, edit, and remove users. All roles can browse the catalog, assets, and notifications. For a detailed breakdown of what each access level can do, see the Permissions reference.
Choosing a role
Match the role to what a person actually needs to do:
| If the person… | Give them… |
|---|---|
| Administers the platform and manages who has access | Global Admin |
| Builds and maintains work across every area but shouldn't delete resources | Global Editor |
| Needs visibility everywhere but changes nothing (execs, analysts, auditors) | Global Viewer |
| Builds and owns data pipelines end to end | Integrations Admin |
| Configures and runs syncs day to day, without removing pipelines | Integrations Editor |
| Creates and maintains monitors and data-quality checks | Observability Admin or Observability Editor |
| Curates the catalog — descriptions, owners, governance | Catalog Admin or Catalog Editor |
| Only needs to watch one area (e.g. check integration status) | The matching Viewer role |
When in doubt, start with the narrowest role that covers the job and add more later — access is easy to expand by editing the user.
Role reference
Global roles
Global roles span every product area.
- Global Admin — complete administrative control over the platform. Grants every Matia permission, including inviting and managing users, deleting resources across all areas, and managing all notification rules. Required to administer Users & Permissions.
- Global Editor — full create and edit access across all modules. Create, edit, trigger, and enable/disable integrations and monitors; manage catalog assets and ownership; edit issues; and manage notification rules everywhere. Cannot delete resources or manage users.
- Global Viewer — read-only access across all modules. View integrations, monitors, catalog, assets, issues, and notifications everywhere, with no ability to make changes.
Integrations roles
Scoped to the Integrations (ETL / Reverse ETL) area. All three also include read access to the catalog and assets.
- Integrations Admin — full control over integrations, including deletion. Everything Integrations Editor can, plus deleting integrations and assets.
- Integrations Editor — create and manage integrations, syncs, and tasks. Create and edit integrations; edit settings, schema, and names; trigger syncs and full re-syncs; enable/disable integrations; edit integration issues; manage integration notification rules; and create/edit assets. Cannot delete.
- Integrations Viewer — browse integrations and view issues. Read-only access to integrations, their settings and issues, the catalog, and assets.
Observability roles
Scoped to the Observability (monitors) area. All levels include read access to the catalog and assets.
- Observability Admin — full control over monitors, including deletion. Everything Observability Editor can, plus deleting monitors, managing monitor notification rules, and managing tags.
- Observability Editor — create and manage monitors, settings, and tags. Create and edit monitors, rename them, trigger them, enable/disable them, and view/edit observability issues. Cannot delete monitors.
- Observability Viewer — browse monitors and view issues. Read-only access to observability, its issues, the catalog, and assets.
Catalog roles
Scoped to the Catalog and data-governance area.
- Catalog Admin — full control over catalog assets, including deletion. Everything Catalog Editor can, plus deleting assets.
- Catalog Editor — create and update catalog assets and ownership. View the catalog, manage owners, manage catalog notification rules, trigger metadata extraction, edit issues and descriptions, and create/edit assets. Cannot delete assets.
Frequently asked questions
Can one person have more than one role? Yes. A user's access is the combined total of every role they hold, so you can stack an area role (like Observability Admin) on top of a broader one.
What's the difference between Editor and Admin? Admins can additionally delete resources and manage notification rules in their area. Global Admin also manages users.
Who can invite and manage users? Only Global Admin. Other roles can use the platform according to their permissions but can't change other people's access.
Someone needs access to two areas — what do I assign? Give them the two matching area roles (for example, Integrations Editor + Catalog Editor), or a single Global role if they need every area.
What happens when I remove a role from a user? They immediately lose the permissions that role granted, unless another role they still hold also grants them.