# Permissions & Scope

{% hint style="success" %}

### Communities, Permissions & Scope

In this hands-on workshop, you'll learn how to configure Community permissions and data source scope restrictions to implement fine-grained access control in PDC. We'll walk through the process of limiting specific Communities to only the data sources and schemas relevant to their business domain, demonstrating how to create secure, business-aligned data governance boundaries that enforce the principle of least privilege.

By the end of this workshop, you will be able to:

* Configure Community scope restrictions to limit access to specific data sources
* Implement domain-based data access controls that mirror organizational structure
* Create business-aligned data boundaries using PDC's scope management features
* Test and validate Community permission restrictions with user authentication
* Understand how Communities enforce data governance policies at the asset level
* Design scalable permission models that grow with organizational complexity
* Apply the principle of least privilege to enterprise data governance

**Workshop Process:** You'll configure the `AdventureWorks_Sales_Analytics` Community to only access sales-related data sources, then test the restriction by logging in as Sarah Johnson (Sales Analyst) to verify she can only see the data sources appropriate for her role.

This workshop demonstrates how Data Catalog's Community scope features create the "WHAT" layer of your data governance framework—determining exactly which data assets each user can access based on their business function and organizational role.
{% endhint %}

***

{% hint style="info" %}

#### Scope Configuration

Let's implement domain-specific access controls for Adventure Works business areas:

* **Sales Community** gets access to `mssql:adventureworks2022-Sales` (Sales + Person schemas only)
* **HR Community** gets access to `mssql:adventureworks2022-HR` (HumanResources + Person schemas)
* **Data Governance Council** gets cross-domain access for governance oversight
* **System /Datasource Administrators** get access to the complete `mssql:adventureworks2022` database
  {% endhint %}

1. Log into Data Catalog:

{% embed url="<https://pdc.pentaho.lab>" %}

Username: <hugo.reilly@adventureworks.com>

&#x20;                    <james.lock@adventureworks.com>

Password: Welcome123!

{% tabs %}
{% tab title="1. Sales Community" %}
{% hint style="info" %}

#### Sales Community

Let's start defining our Sales Community ..
{% endhint %}

{% tabs %}
{% tab title="1. Create AW Sales connection" %}
{% hint style="info" %}

#### AdventureWorks - Sales

**Sales Schema Data Source Creation**

When connecting to the AdventureWorks2022 database, administrators would create a dedicated "mssql:adventureworks2022-Sales" data source. During the "Ingest Schemas" process, click Ingest Schema, select the following schemas:

* Sales    - Orders, customers, territories, sales performance
* Person - Contact information, addresses, demographics

and then click Ingest Schemas.
{% endhint %}

1. Click: Management in the left navigation menu.
2. Create a connection to: adventureworks2022 database with the following settings:

<table><thead><tr><th width="226">Field</th><th>Setting</th></tr></thead><tbody><tr><td>Data Source Name</td><td>mssql:adventureworks2022-sales</td></tr><tr><td>Data Source ID</td><td>Leave Blank to autogenerate ID</td></tr><tr><td>Description</td><td>AW DW: Sales + Person schemas only.</td></tr><tr><td>Data Source Type</td><td>Microsoft SQL Server</td></tr><tr><td>Affinity</td><td>Default</td></tr><tr><td>Configuration Method</td><td><strong>URI</strong></td></tr><tr><td>   Username</td><td>sa</td></tr><tr><td>   Password</td><td>StrongPassword123</td></tr><tr><td>   URI</td><td>jdbc:sqlserver://pdc.pentaho.lab:1433;databaseName=AdventureWorks2022;user=sa;password=StrongPassword123;encrypt=false</td></tr><tr><td>Driver</td><td>mssql-jdbc-13.2.0.jre11.jar*</td></tr><tr><td>Database Name</td><td>AdventureWorks2022</td></tr></tbody></table>

2. Select: Sales + Person schemas.

<figure><img src="/files/qSmYouvu0JPkjzwjw4HQ" alt=""><figcaption><p>Select Schemas</p></figcaption></figure>

3. Save: Data Source.
   {% endtab %}

{% tab title="2. AW Sales Community" %}
{% hint style="info" %}

#### AW Sales Community

{% endhint %}

1. Click: Management in the left navigation menu.

<figure><img src="/files/jW3ny7tGqB4YVd3dIkwy" alt=""><figcaption><p>Users &#x26; Communities</p></figcaption></figure>

3. Click: Communities (Users & Communities tile).
4. Select: **AdventureWorks\_Sales\_Analytics** > Edit

<figure><img src="/files/nnDkBdxBEHHMGo14XWgz" alt=""><figcaption><p>Edit Sales Community</p></figcaption></figure>

5. Scroll down to Scope.

<figure><img src="/files/tvyaStuGgycsHH3oZxWP" alt=""><figcaption><p>AdventureWorks_Sales_Analysts scope</p></figcaption></figure>

6. Select: Data Sources & Click: +
7. Select: mssql:adventureworks2022-Sales & uncheck All

<figure><img src="/files/AiZYgs4p6dX6jo4OM6pb" alt=""><figcaption></figcaption></figure>

8. Click: Done & Save.

{% hint style="warning" %}
While you're here ..  Edit the Scope: Data Sources for AdventureWorks\_System\_Administrators from All to: mssql:adventureworks2022.

We've now set the Data Sources Scope for the Sales Analysts ..  we'll be back to set the others ..!!
{% endhint %}

9. Finally ..  test by logging in as:&#x20;

&#x20;      Username: <Sarah.Johnson@adventureworks.com>

&#x20;      Password: Welcome123!

<figure><img src="/files/7tHFYHwhNHef81nYMMIK" alt=""><figcaption><p>Sales_Analysts</p></figcaption></figure>
{% endtab %}

{% tab title=" 3. Sales Analytics Community" %}
{% hint style="info" %}

#### Sales Analytics Community

Let's review the Adventure Works organization to make sure the Sales business unit users have the required permissions & scope to access the Data Catalog assets:
{% endhint %}

<figure><img src="/files/KipxDzwdCfWd3ifwPMJI" alt=""><figcaption><p>Adventure Works Organization</p></figcaption></figure>

{% hint style="info" %}
At the moment we have cross-domain teams managing the various business units assets. However, we need to start restricting the scope:

When a Sales Analyst - Sarah.Johnson - in the AdventureWorks\_Sales\_Analyst Community logs into Data Catalog they just see a sales-focused environment.&#x20;

They can analyze customer purchase patterns using Sales.SalesOrderHeader and Sales.Customer tables, but cannot access employee salary data from HumanResources.Employee or manufacturing costs from Production.ProductCostHistory.

When searching for "customer," they only see sales-related customer data, not HR employee records.&#x20;

When applying data classification, they see tags relevant to sales operations like "Customer PII," "Sales Sensitive," or "Territory Confidential," but not manufacturing tags like "Trade Secret" or "Production Cost."
{% endhint %}

<table><thead><tr><th width="358">Community</th><th width="107">Schema</th><th width="165">PDC Default Role</th><th width="308">Description</th><th width="149">Users</th></tr></thead><tbody><tr><td>AdventureWorks_Data_Governance_Council</td><td>All</td><td>Data Steward </td><td>Cross-domain data stewardship and governance oversight.</td><td>elena.rodriguez</td></tr><tr><td>AdventureWorks_System_Administrators</td><td>All</td><td><strong>All the Roles</strong></td><td>Full Data Catalog administrative capabilities for system management.</td><td>james.lock</td></tr><tr><td>AdventureWorks_Datasource_Administrators</td><td>All</td><td>Data Storage Administrator</td><td>Adventure Works data source administrators.</td><td>hugo.reilly david.park</td></tr><tr><td>AdventureWorks_Sales_Analytics</td><td>Sales + Person</td><td>Data User</td><td>Sales team data analysis and customer insights.</td><td>sarah.johnson</td></tr><tr><td>AdventureWorks_Compliance_Officers</td><td>All</td><td>Business Steward</td><td>Regulatory compliance monitoring and audit management.</td><td>david.park</td></tr><tr><td>AdventureWorks_HR_Specialist</td><td>HumanResources</td><td>Business User</td><td>HR Specialist</td><td>michael.chen</td></tr></tbody></table>
{% endtab %}
{% endtabs %}
{% endtab %}

{% tab title="2. HR Community" %}
{% hint style="info" %}

#### HR Community

Let's move and repeat the workflow to create a HR Community.
{% endhint %}

{% tabs %}
{% tab title="1. Create AW HR connection" %}
{% hint style="info" %}

#### AdventureWorks - HR

**Sales Schema Data Source Creation**

When connecting to the AdventureWorks2022 database, administrators would create a dedicated "mssql:adventureworks2022-HR" data source. During the "Ingest Schemas" process, click Ingest Schema, select the following schemas:

* HumanResources  - Employee data, departments, payroll information
* Person - Contact information, addresses, demographics

and then click Ingest Schemas.
{% endhint %}

1. Click: Management in the left navigation menu.
2. Create a connection to: adventureworks2022 database with the following settings:

<table><thead><tr><th width="226">Field</th><th>Setting</th></tr></thead><tbody><tr><td>Data Source Name</td><td>mssql:adventureworks2022-HR</td></tr><tr><td>Data Source ID</td><td>Leave Blank to autogenerate ID</td></tr><tr><td>Description</td><td>AW DW: HumanResources + Person schemas only.</td></tr><tr><td>Data Source Type</td><td>Microsoft SQL Server</td></tr><tr><td>Affinity</td><td>Default</td></tr><tr><td>Configuration Method</td><td><strong>URI</strong></td></tr><tr><td>   Username</td><td>sa</td></tr><tr><td>   Password</td><td>StrongPassword123</td></tr><tr><td>   URI</td><td>jdbc:sqlserver://pdc.pentaho.lab:1433;databaseName=AdventureWorks2022;user=sa;password=StrongPassword123;encrypt=false</td></tr><tr><td>Driver</td><td>mssql-jdbc-13.2.0.jre11.jar*</td></tr><tr><td>Database Name</td><td>AdventureWorks2022</td></tr></tbody></table>

2. Select: HumanResources + Person schemas.

<figure><img src="/files/QAF2M4lJb5YSjfEcMEcd" alt=""><figcaption><p>Select Schemas</p></figcaption></figure>

3. Save: Data Source.
   {% endtab %}

{% tab title="2. AW HR Community" %}
{% hint style="info" %}

#### AW HR Community

{% endhint %}

1. Click: Management in the left navigation menu.

<figure><img src="/files/jW3ny7tGqB4YVd3dIkwy" alt=""><figcaption><p>Users &#x26; Communities</p></figcaption></figure>

3. Click: Communities (Users & Communities tile).
4. Select: **AdventureWorks\_HR\_Spcialist** > Edit.

<figure><img src="/files/2zisOvmZAqw2RfXs5tiE" alt=""><figcaption><p>Edit HR Community</p></figcaption></figure>

5. Scroll down to Scope.

<figure><img src="/files/tvyaStuGgycsHH3oZxWP" alt=""><figcaption><p>AdventureWorks_Sales_Analysts scope</p></figcaption></figure>

6. Select: Data Sources & Click: +
7. Select: mssql:adventureworks2022-HR & uncheck All

<figure><img src="/files/AiZYgs4p6dX6jo4OM6pb" alt=""><figcaption></figcaption></figure>

8. Click: Done & Save.

{% hint style="warning" %}
While you're here ..  Edit the Scope: Data Sources for AdventureWorks\_System\_Administrators from All to: mssql:adventureworks2022.

We've now set the Data Sources Scope for the Sales Analysts ..  we'll be back to set the others ..!!
{% endhint %}

9. Finally ..  test by logging in as:&#x20;

&#x20;      Username: <micheal.chen@adventureworks.com>

&#x20;      Password: Welcome123!

x

x
{% endtab %}
{% endtabs %}
{% endtab %}

{% tab title="3. Other Communities" %}
x

{% hint style="info" %}

#### Other Communities

* **Production**: Products, inventory, manufacturing processes
* **Purchasing**: Vendors, purchase orders, procurement data
  {% endhint %}

x

x
{% endtab %}
{% endtabs %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://academy.pentaho.com/pentaho-data-catalog-en/data-catalog/data-discovery/permissions-and-scope.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.