DataWorks workspace member role | MaxCompute role | Permission on data in the DataWorks development environment and the related MaxCompute project | Permission on data in the DataWorks production environment and the related MaxCompute project | Description of permissions in DataWorks |
Workspace Administrator | Role_Project_Admin | MaxCompute: This role has all permissions on the project and the tables, functions, resources, instances, and jobs in the project, the Read permissions on the packages in the project, and management permissions on the tables, functions, resources, and instances, including permissions to create tables, functions, resources, and instances. DataWorks: This role has permissions to perform data development operations and deploy tasks to the production environment.
| No permissions by default. You must apply for the required permissions in Security Center. | A user with the Workspace Administrator role is the administrator of a workspace. The administrator has permissions to manage the basic properties, data sources, compute engine configurations, and members of the workspace and can assign the Workspace Administrator, Develop, O&M, Deploy, or Visitor role to workspace members. |
Develop | Role_Project_Dev | MaxCompute: This role has all permissions on the project and the tables, functions, resources, instances, and jobs in the project, and the Read permissions on the packages in the project. DataWorks: This role has permissions to perform data development operations, but does not have permissions to deploy tasks to the production environment.
| A user with the Develop role has permissions to create workflows, script files, resources, user-defined functions (UDFs), tables, and deployment tasks, and delete tables, but does not have permissions to perform deployment operations. |
O&M | Role_Project_Pe | This role has all permissions on the project and the functions, resources, instances, and jobs in the project, the Read permissions on the packages in the project, and the Read and Describe permissions on the tables in the project. Note The O&M role has permissions on the MaxCompute compute engine, but does not have permissions to run nodes in the DataWorks console. | A user with the O&M role has deployment and online O&M permissions that are granted by the Workspace Administrator role, but does not have permissions to perform data development operations. |
Deploy | Role_Project_Deploy | No permissions by default. | A user with the Deploy role has similar permissions to the O&M role, except for online O&M permissions. |
Data Analyst | Role_Project_Data_Analyst | No permissions by default. | By default, a user with the Data Analyst role has permissions only on DataAnalysis. |
Visitor | Role_Project_Guest | No permissions by default. | A user with the Visitor role has permissions to view data, but does not have permissions to modify workflows or code. |
Security Administrator | Role_Project_Security | No permissions by default. | A user with the Security Administrator role can be used only in Data Security Guard and has permissions to configure sensitive data identification rules and audit data risks in Data Security Guard. |
Model Designer | Role_Project_Erd | No permissions by default. | A user with the Model Designer role has permissions to view models and modify parameter configurations in Data Warehouse Planning, Data Standard, Dimensional Modeling, and Data Metric, but does not have permissions to publish models. |
N/A | Project Owner | This identity is the owner of the project and has all permissions on the project. | This role has the same permissions in the production environment as in the development environment. | N/A |
N/A | Super_Administrator | This role is the super administrator of the project and has management permissions on the project and all permissions on all types of resources in the project. | This role has the same permissions in the production environment as in the development environment. | N/A |
N/A | Admin | When you create a project, the system creates an Admin role for this project and grants the role permissions to access all objects in the project, manage users or roles, and grant permissions to users or roles. In contrast to the Project Owner role, the Admin role does not have permissions to perform the following operations: assign the Admin role to users, configure security policies for the project, modify the authentication model for the project, and modify the permissions of the Admin role. The Project Owner role can assign the Admin role to a user and authorize the user to manage security configurations. | This role has the same permissions in the production environment as in the development environment. | N/A |
Elastic Compute Service (ECS)
Container Compute Service (ACS)
icon in the upper-left corner of the page. All services of DataWorks that are shown in the following figure are displayed. 
You can click a service to go to the page of the service. On the page of a service, you can determine whether the service is a workspace-level or global-level service in the following way:
After the RAM user is added to the DataWorks workspace as a member and is assigned the Develop role, the RAM user has specified permissions on DataWorks services and the MaxCompute compute engine for which the related MaxCompute data source is added to the workspace. 
When you create a custom workspace-level role, you can specify whether this role is mapped to a role of the MaxCompute compute engine for which the related MaxCompute data source is added to the workspace. After the custom workspace-level role is assigned to the RAM user, the RAM user has specified permissions on DataWorks services and the MaxCompute compute engine. 
