> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.cloudquant.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Administration Overview
> Manage users, dataset entitlements, and fine-grained access controls in the CloudQuant Data Liberator admin portal
# Administration overview
The CloudQuant Data Liberator admin portal lets organization administrators control who can access the platform and which datasets each user can query. Access is managed through **entitlements** — explicit grants to datasets, dataset groups, and connections — with optional **fine-grained permissions** that restrict query scope.
## Who can manage access
The admin portal uses a role hierarchy. Each role can assign roles at or below its own level.
| Role | Description |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| **User** | Query entitled datasets. No admin portal access. |
| **Admin** | Manage connections, datasets, and user groups. Can add existing user accounts to the permissions system. |
| **Super Admin** | Full platform administration — create users, edit roles, assign entitlements, configure fine-grained permissions, and deactivate users. |
Most user and entitlement management actions described in this section require **Super Admin**. Admins can view the Users page and add users to Liberator, but editing user details, assigning dataset entitlements, and deactivating users are Super Admin actions.
## Permission model
Access is layered:
1. **Platform role** (`user`, `admin`, `super_admin`) — controls what a person can do in the admin portal.
2. **Connection entitlements** — grant access to all datasets within a connection. Datasets inherited from a connection appear as locked in the permissions UI.
3. **Dataset entitlements** — grant access to individual datasets at **Editor** or **User** level.
4. **Dataset group entitlements** — grant access to a curated bundle of datasets defined in **Dataset Groups**.
5. **Fine-grained permissions** — optional per-dataset or per-group restrictions on date range, query type, row limits, keys, and columns.
```mermaid theme={null}
flowchart TD
A[User account] --> B[Platform role]
A --> C[Connection entitlements]
A --> D[Dataset entitlements]
A --> E[Dataset group entitlements]
D --> F[Fine-grained permissions]
E --> F
C --> G[Inherited dataset access]
```
### Editor vs user
For datasets and connections, entitlements are assigned at one of two levels:
| Level | Meaning |
| ---------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Editor** | Full access to query the dataset (or all datasets in a connection). |
| **User** | Query access at the usage level. In the UI this is labeled **User**; internally it maps to the usage entitlement tier. |
When a user has connection-level access, all datasets in that connection are inherited automatically. Those datasets cannot be individually removed until the connection entitlement is revoked.
## Admin portal navigation
Super Admins and Admins see these relevant sections in the sidebar:
| Page | Purpose |
| ------------------ | ------------------------------------------------------------------ |
| **Users** | Add users, assign entitlements, configure fine-grained permissions |
| **User Groups** | Manage groups of users for bulk entitlement assignment |
| **Dataset Groups** | Manage bundles of datasets for bulk entitlement assignment |
| **Connections** | Configure data source connections |
| **Datasets** | View and manage individual datasets |
## Related guides
Add, create, deactivate users and grant or revoke dataset access
Restrict query date ranges, row limits, keys, and columns per user
Public vs private datasets and the Publicly Available toggle
Schedule warm Parquet caches in S3 or GCS before users query
Lookup-table enrichment with translate=true
Authentication, network security, and the end-user view of entitlements
How users verify their entitled datasets from Python