Identity and Access Management (IAM) permissions let you control granular access to
Knowledge Catalog (formerly Dataplex Universal Catalog) resources across metadata management, data scans,
lakes, zones, assets, tasks, and environments. Because you don't grant
permissions directly to principals, you can assign predefined roles for common
use cases or bundle specific permissions into custom roles to enforce the
principle of least privilege.

This document lists the IAM permissions required to run specific
operations and API methods in Knowledge Catalog. For more information
about predefined roles, see
[Knowledge Catalog IAM roles](https://docs.cloud.google.com/knowledge-catalog/docs/iam-roles.md.txt).
For more information about IAM, see
[IAM overview](https://docs.cloud.google.com/iam/docs/overview.md.txt).

## IAM policy Set and Get permissions

The following table lists the permissions required to get and set
IAM permissions:

| Resource | API method | IAM permission |
|---|---|---|
| Aspect types | [`GetIamPolicy`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.aspectTypes/getIamPolicy.md.txt) | dataplex.aspectTypes.getIamPolicy |
| Aspect types | [`SetIamPolicy`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.aspectTypes/setIamPolicy.md.txt) | dataplex.aspectTypes.setIamPolicy |
| Entry groups | [`GetIamPolicy`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups/getIamPolicy.md.txt) | dataplex.entryGroups.getIamPolicy |
| Entry groups | [`SetIamPolicy`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups/setIamPolicy.md.txt) | dataplex.entryGroups.setIamPolicy |
| Entry types | [`GetIamPolicy`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryTypes/getIamPolicy.md.txt) | dataplex.entryTypes.getIamPolicy |
| Entry types | [`SetIamPolicy`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryTypes/setIamPolicy.md.txt) | dataplex.entryTypes.setIamPolicy |
| Lakes | [`GetIamPolicy`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes/getIamPolicy.md.txt) | dataplex.lakes.getIamPolicy |
| Lakes | [`SetIamPolicy`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes/setIamPolicy.md.txt) | dataplex.lakes.setIamPolicy |

## Metadata management permissions

The set of permissions that is required to perform operations on entry types,
entry link types, aspect types, entry groups, entries, and entry links depends
on whether the resources are system resources or custom resources. System
resources are defined by Knowledge Catalog, and custom resources are
defined by you or your organization.

> [!NOTE]
> **Note:** Only system entry link types are supported.

To enrich entries and entry links with additional information, you can attach
aspects.

To perform operations that are related to multiple resources (for example,
creating an entry of a particular entry type, or adding an aspect of a
particular aspect type to an entry or entry link), you might need multiple
permissions associated with the resources.

### Entry types

To create and manage entry types, you must be granted at least the standard
`create`, `get`, `list`, `update`, and `delete` permissions.

When you create an entry type, you must be granted permissions to use each
aspect type you want to mark as required for that entry type.

To use an entry type (for example, to create entries of an entry type), you must
be granted the `use` permission on the entry type.

The following table lists the permissions required for operating on entry types:

| Operation | IAM permission |
|---|---|
| [`Create entry types`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryTypes/create.md.txt) | `dataplex.entryTypes.create` `dataplex.aspectTypes.use` (for every required aspect type in the entry type) `dataplex.entryGroups.useASPECT_TYPE` (for every required system aspect type in the entry type). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). |
| [`Delete entry types`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryTypes/delete.md.txt) | `dataplex.entryTypes.delete` `dataplex.aspectTypes.use` (for required aspect types in the entry types) `dataplex.entryGroups.useASPECT_TYPE` (for every required system aspect type in the entry type). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). |
| [`Get entry types`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryTypes/get.md.txt) | `dataplex.entryTypes.get` |
| [`List entry types`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryTypes/list.md.txt) | `dataplex.entryTypes.list` |
| [`Update entry types`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryTypes/patch.md.txt) | `dataplex.entryTypes.update` `dataplex.aspectTypes.use` (for every required aspect type in the entry type) `dataplex.entryGroups.useASPECT_TYPE` (for every required system aspect type in the entry type). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). |
| Use entry types (when creating entries, updating top-level entry fields and required aspect type values) | `dataplex.entryTypes.use` `dataplex.entries.create` or `dataplex.entries.update` `dataplex.aspectTypes.use` (for every aspect created or updated) |

### Aspect types

To create and manage aspect types, you must be granted the standard `create`,
`get`, `list`, `update`, and `delete` permissions.

To use an aspect type (for example, to attach it as an optional aspect on an
entry or update required aspect on the entry link), you must be granted the
`use` permission on the aspect type.

Aspect types are categorized into system aspect types and custom aspect types.
System aspect types are created by Knowledge Catalog and custom aspect
types are created by you or your organization. System aspect types are further
categorized into usable and read-only. For more information, see [Categories of
aspect
types](https://docs.cloud.google.com/knowledge-catalog/docs/enrich-entries-metadata#categories-aspect-types).

The following table lists the permissions required for operating on custom and
system aspect types:

| Operation | Permissions required for custom aspect types | Permissions required for usable system aspect types | Permissions required for read-only system aspect types |
|---|---|---|---|
| [`Create aspect types`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.aspectTypes/create.md.txt) | `dataplex.aspectTypes.create` | Not applicable | Not applicable |
| [`Delete aspect types`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.aspectTypes/delete.md.txt) | `dataplex.aspectTypes.delete` | Not applicable | Not applicable |
| [`Get aspect types`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.aspectTypes/get.md.txt) | `dataplex.aspectTypes.get` | Granted to `allUsers` | Granted to `allUsers` |
| [`List aspect types`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.aspectTypes/list.md.txt) | `dataplex.aspectTypes.list` | Not applicable | Not applicable |
| When creating or updating entries, set optional aspect type values | `dataplex.aspectTypes.use` `dataplex.entries.create` or `dataplex.entries.update` | `dataplex.entryGroups.useASPECT_TYPE`. See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). `dataplex.entries.create` or `dataplex.entries.update` | Not applicable |
| When creating or updating entries, set required aspect type values | `dataplex.aspectTypes.use` `dataplex.entryTypes.use` `dataplex.entries.create` or `dataplex.entries.update` | `dataplex.entryGroups.useASPECT_TYPE`. See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). `dataplex.entryTypes.use` `dataplex.entries.create` or `dataplex.entries.update` | Not applicable |
| [`Update aspect types`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.aspectTypes/patch.md.txt) | `dataplex.aspectTypes.update` | N/A | N/A |
| Set required aspect type values when creating or updating entry link | N/A | `dataplex.entryGroups.useASPECT_TYPE`. See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). `dataplex.entryLinkTypes.useENTRY_LINK_TYPE`. See the [permissions for system entry link types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). `dataplex.entries.link` Granted on entry group(s) containing linked entries. Only checked during entry link creation. `dataplex.entryLinks.create` or `dataplex.entryLinks.update` | N/A |

### Entry groups

To create and manage entry groups, you must be granted the standard `create`,
`get`, `list`, `update`, and `delete` permissions.

> [!NOTE]
> **Note:** You can't modify or delete the system entry groups whose names start with the `@` symbol, such as `@bigquery`. You can only add optional aspects to the entries in such entry groups.

Entry groups are categorized into system entry groups, which are created by
Knowledge Catalog, and custom entry groups, which are created by you or
your organization. For more information, see [Categories of entry
groups](https://docs.cloud.google.com/knowledge-catalog/docs/ingest-custom-sources#categories-entry-groups).

The following table lists the permissions required for operating on entry
groups:

| Operation | Permissions required for custom entry groups | Permissions required for system entry groups (starting with @) |
|---|---|---|
| [`Create entry groups`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups/create.md.txt) | `dataplex.entryGroups.create` | Not applicable |
| [`Delete entry groups`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups/delete.md.txt) | `dataplex.entryGroups.delete` | Not applicable |
| [`Get entry groups`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups/get.md.txt) | `dataplex.entryGroups.get` | `dataplex.entryGroups.get` |
| [`List entry groups`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups/list.md.txt) | `dataplex.entryGroups.list` | `dataplex.entryGroups.list` |
| [`Update entry groups`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups/patch.md.txt) | `dataplex.entryGroups.update` | Not applicable |

### Entries

To create and manage entries, you must be granted the standard `create`, `get`,
`list`, `update`, and `delete` permissions.

Note the following:

- For lookup (`<code>LookupEntry</code>`) and search (`<code>SearchEntries</code>`) methods, the permission from the original source system is required on the entry. For example, if the source is a BigQuery table, you need `bigquery.tables.get` permission to view metadata, and `bigquery.tables.getData` to view [data aspects](https://docs.cloud.google.com/knowledge-catalog/docs/enrich-entries-metadata.md.txt#data-aspects).
- If permission to view [data aspects](https://docs.cloud.google.com/knowledge-catalog/docs/enrich-entries-metadata.md.txt#data-aspects) is not present, entries are still visible, but the contents of data aspects are hidden.
- When you create an entry or update the top-level fields of an entry, you must be granted the `use` permission on the entry type.
- When you create or update a required aspect, you must be granted the `use` permission on the entry type of an entry, as well as on the underlying aspect type. This is because the required aspects are enforced by the entry type.
- When you create, update, or delete an optional aspect, you must be granted the `use` permission on the aspect type of an aspect.
- When you upsert an entry (`<code>UpdateEntry</code>` with `<code>allow_missing = True</code>`), you must be granted the `create` permission.

For more information about the entry types entries are based on, see [Categories
of entry
types](https://docs.cloud.google.com/knowledge-catalog/docs/ingest-custom-sources#categories-entry-types).

The following table lists the permissions required for operating on entries:

| Operation | Entry based on custom entry type | Entry based on usable system entry type | Entry based on read-only system entry type |
|---|---|---|---|
| [`Create entries`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups.entries/create.md.txt) | `dataplex.entries.create` `dataplex.entryTypes.use` `dataplex.aspectTypes.use` (for every custom aspect created) `dataplex.entryGroups.useASPECT_TYPE` (for every aspect of a usable system aspect type created). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). | `dataplex.entries.create` `dataplex.entryGroups.useENTRY_TYPE`. See the [permissions for system entry types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). `dataplex.entryGroups.useASPECT_TYPE` (for every system aspect created). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). `dataplex.aspectTypes.use` (for every custom aspect created) | Not applicable |
| [`Get entries`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups.entries/get.md.txt) | `dataplex.entries.get` To view [data aspects](https://docs.cloud.google.com/knowledge-catalog/docs/enrich-entries-metadata.md.txt#data-aspects), `dataplex.entries.getData` is also required. | `dataplex.entries.get` To view [data aspects](https://docs.cloud.google.com/knowledge-catalog/docs/enrich-entries-metadata.md.txt#data-aspects), `dataplex.entries.getData` is also required. | `dataplex.entries.get` To view [data aspects](https://docs.cloud.google.com/knowledge-catalog/docs/enrich-entries-metadata.md.txt#data-aspects), `dataplex.entries.getData` is also required. |
| [`List entries`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups.entries/list.md.txt) | `dataplex.entries.list` | `dataplex.entries.list` | `dataplex.entries.list` |
| [`Lookup entries`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations/lookupEntry.md.txt) | Requires metadata read permission of the source system. Permission to read data from the source system is required to view [data aspects](https://docs.cloud.google.com/knowledge-catalog/docs/enrich-entries-metadata.md.txt#data-aspects). For custom entries, where Knowledge Catalog is treated as the source system, these permissions are `dataplex.entries.get` and `dataplex.entries.getData`, respectively. | Requires metadata read permission of the source system. Permission to read data from the source system is required to view [data aspects](https://docs.cloud.google.com/knowledge-catalog/docs/enrich-entries-metadata.md.txt#data-aspects). For custom entries, where Knowledge Catalog is treated as the source system, these permissions are `dataplex.entries.get` and `dataplex.entries.getData`, respectively. | Requires metadata read permission of the source system. Permission to read data from the source system is required to view [data aspects](https://docs.cloud.google.com/knowledge-catalog/docs/enrich-entries-metadata.md.txt#data-aspects). For custom entries, where Knowledge Catalog is treated as the source system, these permissions are `dataplex.entries.get` and `dataplex.entries.getData`, respectively. |
| [`Search entries`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations/searchEntries.md.txt) | Read permission of the original source system. For custom entries, this is `dataplex.entries.get`, because Knowledge Catalog is treated as the original source system. | Read permission of the original source system. For custom entries, this is `dataplex.entries.get`, because Knowledge Catalog is treated as the original source system. | Read permission of the original source system. For custom entries, this is `dataplex.entries.get`, because Knowledge Catalog is treated as the original source system. |
| [`Update entries`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups.entries/patch.md.txt) | `dataplex.entries.update` `dataplex.entryTypes.use` (for updating top-level fields or required aspects) `dataplex.aspectTypes.use` (for every aspect updated) `dataplex.entryGroups.useASPECT_TYPE` (for every system aspect updated). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). `dataplex.entries.create` (if `allow_missing` is `True`) | `dataplex.entries.update` `dataplex.entryGroups.useENTRY_TYPE` (for updating top-level fields or required aspects). See the [permissions for system entry types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). `dataplex.aspectTypes.use` (for every custom aspect updated) `dataplex.entryGroups.useASPECT_TYPE` (for every aspect that belongs to system aspect types). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). `dataplex.entries.create` (if `allow_missing` is `True`) | `dataplex.entries.update` `dataplex.aspectTypes.use` (for every custom aspect updated) `dataplex.entryGroups.useASPECT_TYPE` (for every aspect of a usable system aspect type updated). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). Top-level fields and required aspects can't be edited. |

### Entry Links

To create and manage entry links, you must be granted `create`, `get`, `list`,
and `delete` permissions on `dataplex.entryLinks`.

Note the following:

- Creating entry links (`CreateEntryLink`) also requires permissions on the entry link type and permissions to the link specific entries.
- When creating an entry link with a *required* aspect, you need the permissions to use the aspect type.
- When upserting an entry link (`UpdateEntryLink` with `allow_missing =
  True`), you must also have the same permissions required for `CreateEntryLink`.

The following table lists the permissions required for operating on entry links:

| Operation | IAM permission |
|---|---|
| [Create entry links](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups.entryLinks/create.md.txt) | `dataplex.entryLinks.create` (on the entry group) Permissions required based on **Entry Link Type**: - **Synonym:** `dataplex.glossaryTerms.use` (on both term entries) - **Definition:** `dataplex.glossaryTerms.use` (on the term entry) and `dataplex.entries.link` (on the target entry) - **Other:** `dataplex.entries.link` (on both entries) Permission to use the entry link type: - For system types: `dataplex.entryGroups.useENTRY_LINK_TYPE` (on the entry group). See the [permissions for system entry link types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). Permissions for any required aspects specified by the entry link type: - For system types: `dataplex.entryGroups.useASPECT_TYPE` (on the entry group). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). |
| [Delete entry links](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups.entryLinks/delete.md.txt) | `dataplex.entryLinks.delete` (on the entry group) |
| [Get entry links](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups.entryLinks/get.md.txt) | `dataplex.entryLinks.get` (on the entry group) |
| [Lookup entry links](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations/lookupEntryLinks.md.txt) | Requires metadata read permission of the source system on the entry for which entry links are looked up for. For linked custom entries, where Knowledge Catalog is treated as the source system, the permissions is `dataplex.entries.get`. For linked system entries, the permission is read permission of the source system of the linked entry. |
| [Update entry link](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.entryGroups.entryLinks/patch.md.txt) | `dataplex.entryLinks.update` (on the entry group) Permission to use the entry link type: - For system types: `dataplex.entryGroups.useENTRY_LINK_TYPE` (on the entry group). See the [permissions for system entry link types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). Permissions for any required aspects specified by the entry link type: - For system types: `dataplex.entryGroups.useASPECT_TYPE` (on the entry group). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). If `allow_missing` is `True`, additionally, all permissions from `Create entry link` apply. |

#### Limitations for Aspects on Entry Links

The following [limitations](https://docs.cloud.google.com/knowledge-catalog/docs/enrich-entries-metadata.md.txt#create-aspects-for-entry-links)
apply to using aspects with entry links.

### Context sets

Context sets are bounded containers of target data assets and metadata used to
ground AI models in your proprietary business logic. While they can contain
database-specific information, such as SQL query templates or value search
queries for text-to-SQL tools like QueryData, Knowledge Studio also uses context
sets to house terminology glossaries, structured table overviews, and enterprise
data mappings.

For more information on how context sets are used across Google Cloud, see the
context sets overview for [Knowledge
Studio](https://docs.cloud.google.com/knowledge-catalog/docs/context-sets), [AlloyDB for
PostgreSQL](https://docs.cloud.google.com/gemini/data-agents/querydata/alloydb/context-sets-overview), [Cloud
SQL for MySQL](https://docs.cloud.google.com/gemini/data-agents/querydata/sql-mysql/context-sets-overview),
[Cloud SQL for
PostgreSQL](https://docs.cloud.google.com/gemini/data-agents/querydata/sql-postgres/context-sets-overview),
or [Spanner](https://docs.cloud.google.com/gemini/data-agents/querydata/spanner/context-sets-overview.md.txt).

To create and manage context sets for AI grounding, you must be granted the
following IAM roles:

- **Dataplex Catalog Viewer** (`roles/dataplex.catalogViewer`): Read-only access to view, list, and download context sets, and to view locations.
- **Dataplex Catalog Editor** (`roles/dataplex.catalogEditor`): Access to update, delete, upload, and download context sets.
- **Dataplex Catalog Admin** (`roles/dataplex.catalogAdmin`) or **Dataplex
  Entry Group Owner** (`roles/dataplex.entryGroupOwner`): Full administrative access to context sets, including the `dataplex.entryGroups.setIamPolicy` permission required to create context sets.

The following table lists the IAM permissions required for
operating on context sets:

| Operation | IAM permission |
|---|---|
| Create context sets | `dataplex.entryGroups.createContextSet` |
| Delete context sets | `dataplex.entryGroups.deleteContextSet` |
| Read context sets | `dataplex.entryGroups.getContextSet` |
| Update context sets | `dataplex.entryGroups.updateContextSet` |
| Request context changes | `dataplex.entryGroups.requestContextChanges` |
| Create context entries | `dataplex.entries.createContext` |
| Delete context entries | `dataplex.entries.deleteContext` |
| Read context entries | `dataplex.entries.getContext` |
| List context entries | `dataplex.entries.listContext` |
| Update context entries | `dataplex.entries.updateContext` |

For more information, see [Knowledge Catalog IAM
roles](https://docs.cloud.google.com/knowledge-catalog/docs/iam-roles).

### Metadata job permissions

The following table lists the permissions required for working with [metadata
import jobs](https://docs.cloud.google.com/knowledge-catalog/docs/import-metadata) and [metadata export
jobs](https://docs.cloud.google.com/knowledge-catalog/docs/export-metadata).

| Operation | IAM permission |
|---|---|
| Access the exported results from metadata export jobs | `storage.objects.get` |
| [`Cancel metadata jobs`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.metadataJobs/cancel.md.txt) | `dataplex.metadataJobs.cancel` |
| [`Create metadata export jobs`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.metadataJobs/create.md.txt) | `dataplex.metadataJobs.create` `dataplex.entryGroups.export` `dataplex.entryGroups.get` `resourcemanager.projects.get` `resourcemanager.projects.list` |
| [`Create metadata import jobs`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.metadataJobs/create.md.txt) | `dataplex.metadataJobs.create` `dataplex.entryTypes.use` (for custom entry types in the job's scope) `dataplex.entryTypes.useENTRY_TYPE` (for every system entry type in the job's scope). See the [permissions for system entry types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). However, this permission isn't needed to modify optional aspects when running an aspect-only metadata import job. `dataplex.aspectTypes.use` (for custom aspect types in the job's scope) `dataplex.aspectTypes.useASPECT_TYPE` (for every system aspect type in the job's scope). See the [permissions for system aspect types](https://docs.cloud.google.com/knowledge-catalog/docs/iam-permissions.md.txt#system-aspect-types-entry-types-entry-link-types). `dataplex.entryGroups.import` (for entry groups in the job's scope) |
| [`Get metadata jobs`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.metadataJobs/get.md.txt) | `dataplex.metadataJobs.get` |
| [`List metadata jobs`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.metadataJobs/list.md.txt) | `dataplex.metadataJobs.list` |

### System aspect types, entry types, and entry link types

Each system-defined aspect type, system-defined entry type and system-defined
entry link type has its own IAM permissions. These permissions
use a format like `dataplex.entryGroups.useASPECT_TYPE`,
`dataplex.entryGroups.useENTRY_TYPE` or
`dataplex.entryGroups.useENTRY_LINK_TYPE`. For example,
the permission for the `overview` system aspect type is
`dataplex.entryGroups.useOverviewAspect`.

The following table lists the permissions that apply to system-defined aspect
types, entry types and entry link types.

| Resource | IAM permission |
|---|---|
| `contacts` (system aspect type) | `dataplex.entryGroups.useContactsAspect` |
| `data-profile` (system aspect type) | `dataplex.entryGroups.useDataProfileAspect` |
| `data-quality-rule-template` (system aspect type) | `dataplex.entryGroups.useDataQualityRuleTemplateAspect` |
| `data-quality-scorecard` (system aspect type) | `dataplex.entryGroups.useDataQualityScorecardAspect` |
| `data-rules` (system aspect type) | `dataplex.entryGroups.useDataRulesAspect` |
| `generic` (system aspect type) | `dataplex.entryGroups.useGenericAspect` |
| `guidelines` (system aspect type) | `dataplex.entryGroups.useGuidelinesAspect` |
| `overview` (system aspect type) | `dataplex.entryGroups.useOverviewAspect` |
| `schema` (system aspect type) | `dataplex.entryGroups.useSchemaAspect` |
| `schema-join` (system aspect type) | `dataplex.entryGroups.useSchemaJoinAspect` |
| `generic` (system entry type) | `dataplex.entryGroups.useGenericEntry` |
| `definition` (system entry link type) | `dataplex.entryGroups.useDefinitionEntryLink` |
| `related` (system entry link type) | `dataplex.entryGroups.useRelatedEntryLink` |
| `synonym` (system entry link type) | `dataplex.entryGroups.useSynonymEntryLink` |
| `schema-join` (system entry link type) | `dataplex.entryGroups.useSchemaJoinEntryLink` |

## Lake, zone, and asset permissions

The following table lists the permissions required for operating on lakes,
zones, and assets:

| API method | IAM permission |
|---|---|
| [`CreateAsset`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.assets/create.md.txt) | dataplex.assets.create |
| [`CreateLake`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes/create.md.txt) | dataplex.lakes.create |
| [`CreateZone`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones/create.md.txt) | dataplex.zones.create |
| [`DeleteAsset`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.assets/delete.md.txt) | dataplex.assets.delete |
| [`DeleteLake`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes/delete.md.txt) | dataplex.lakes.delete |
| [`DeleteZone`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones/delete.md.txt) | dataplex.zones.delete |
| [`GetAsset`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.assets/get.md.txt) | dataplex.assets.get |
| [`GetLake`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes/get.md.txt) | dataplex.lakes.get |
| [`GetZone`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones/get.md.txt) | dataplex.zones.get |
| [`ListAssetActions`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.assets.actions/list.md.txt) | dataplex.assetActions.list |
| [`ListAssets`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.assets/list.md.txt) | dataplex.assets.list |
| [`ListLakeActions`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.actions/list.md.txt) | dataplex.lakeActions.list |
| [`ListLakes`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes/list.md.txt) | dataplex.lakes.list |
| [`ListZoneActions`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.actions/list.md.txt) | dataplex.zoneActions.list |
| [`ListZones`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones/list.md.txt) | dataplex.zones.list |
| [`UpdateAsset`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.assets/patch.md.txt) | dataplex.assets.update |
| [`UpdateLake`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes/patch.md.txt) | dataplex.lakes.update |
| [`UpdateZone`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones/patch.md.txt) | dataplex.zones.update |

## Task permissions

The following table lists the permissions required for operating on tasks:

| API method | IAM permission |
|---|---|
| [`CancelJob`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.tasks.jobs/cancel.md.txt) | dataplex.tasks.cancel |
| [`CreateTask`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.tasks/create.md.txt) | dataplex.tasks.create |
| [`DeleteTask`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.tasks/delete.md.txt) | dataplex.tasks.delete |
| [`GetJob`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.tasks.jobs/get.md.txt) | dataplex.tasks.get |
| [`GetTask`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.tasks/get.md.txt) | dataplex.tasks.get |
| [`ListJobs`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.tasks.jobs/list.md.txt) | dataplex.tasks.get |
| [`ListTasks`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.tasks/list.md.txt) | dataplex.tasks.list |
| [`UpdateTask`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.tasks/patch.md.txt) | dataplex.tasks.update |

## Metadata permissions

The following table lists the permissions required for operating on entities and
partitions:

| API method | IAM permission |
|---|---|
| [`CreateEntity`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.entities/create.md.txt) | dataplex.entities.create |
| [`CreatePartition`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.entities.partitions/create.md.txt) | dataplex.partitions.create |
| [`DeleteEntity`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.entities/delete.md.txt) | dataplex.entities.delete |
| [`DeletePartition`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.entities.partitions/delete.md.txt) | dataplex.partitions.delete |
| [`GetEntity`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.entities/get.md.txt) | dataplex.entities.get |
| [`GetPartition`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.entities.partitions/get.md.txt) | dataplex.partitions.get |
| [`ListEntities`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.entities/list.md.txt) | dataplex.entities.list |
| [`ListPartitions`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.lakes.zones.entities.partitions/list.md.txt) | dataplex.partitions.list |

## Data scan permissions

The following table lists the permissions required for operating on data scans:

| API method | IAM permission |
|---|---|
| [`CancelDataScanJob`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans.jobs/cancel.md.txt) | dataplex.datascans.cancel |
| [`CreateDataScan`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans/create.md.txt) | dataplex.datascans.create |
| [`DeleteDataScan`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans/delete.md.txt) | dataplex.datascans.delete |
| [`GetDataScan` (basic view)](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans/get.md.txt) | dataplex.datascans.get |
| [`GetDataScan` (full view)](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans/get.md.txt) | dataplex.datascans.getData |
| [`GetDataScanJob` (basic view)](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans.jobs/get.md.txt) | dataplex.datascans.get |
| [`GetDataScanJob` (full view)](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans.jobs/get.md.txt) | dataplex.datascans.getData |
| [`ListDataScanJobs`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans.jobs/list.md.txt) | dataplex.datascans.get |
| [`ListDataScans`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans/list.md.txt) | dataplex.datascans.list |
| [`RunDataScan`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans/run.md.txt) | dataplex.datascans.run |
| [`UpdateDataScan`](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataScans/patch.md.txt) | dataplex.datascans.update |

## Knowledge Studio enrichment tasks

> [!WARNING]
>
> **Preview**
>
>
> This product or feature is
>
> subject to the "Pre-GA Offerings Terms" in the General Service Terms section
> of the [Service Specific
> Terms](https://docs.cloud.google.com/terms/service-terms#1).
>
> Pre-GA products and features are available "as is" and might have limited support.
>
> For more information, see the
> [launch stage descriptions](https://cloud.google.com/products/#product-launch-stages).

The following permissions are required for creating and managing
Knowledge Studio enrichment tasks:

| Operation | IAM permission |
|---|---|
| Create enrichment tasks | `dataplex.agentTasks.create` |
| Delete enrichment tasks | `dataplex.agentTasks.delete` |
| Read enrichment task details | `dataplex.agentTasks.get` |
| Read and fetch underlying data results | `dataplex.agentTasks.getData` |
| List enrichment tasks | `dataplex.agentTasks.list` |
| Update enrichment tasks | `dataplex.agentTasks.update` |
| Run enrichment tasks | `dataplex.agentTasks.run` |
| Request changes to entry groups (proposals) | `dataplex.entryGroups.requestChanges` |
| Approve metadata change requests | `dataplex.changeRequests.use` |

### Third-party auth providers permissions

When configuring external connectors, the following Agent Identity permissions
are required to manage Auth Providers:

| Operation | IAM permission |
|---|---|
| Create Auth Providers | `agentidentity.authProviders.create` |
| View Auth Provider details | `agentidentity.authProviders.get` |
| Delete Auth Providers | `agentidentity.authProviders.delete` |
| Update Auth Providers | `agentidentity.authProviders.update` |

### BigQuery profiling permissions

To allow the enrichment agent to perform BigQuery data profiling
and read table query history, you must grant the **BigQuery Data Viewer**
(`roles/bigquery.dataViewer`) and **BigQuery Resource Viewer**
(`roles/bigquery.resourceViewer`) roles to the target project's
**Knowledge Catalog Service Agent**
(`service-<var>PROJECT_NUMBER</var>@gcp-sa-dataplex.iam.gserviceaccount.com`).