Permissions matrix
Datum checks permission in two layers: the endpoint class (what kind of action you may take at all) and your role's attribute privileges and walls (which records and fields). This page covers the first layer. Your own account panel always states what you hold — see Palette, notifications and your account.
The endpoint classes
| Class | In words | Held in the demonstration firm by |
|---|---|---|
mdm:read | Read mastered records | Fee earner, Data steward, Integration service |
mdm:xref | Resolve a source key to a record | Fee earner, Data steward, Integration service |
mdm:steward | Stewardship: merge, adjudicate, approve | Data steward |
mdm:extract | Take a bulk extract | Data steward, Integration service |
mdm:admin | Administer the platform | Platform administrator |
Screens
"Needs" is the class the screen's own read needs. The rail offers a screen only to people who hold it where the screen is gated; for others it offers the screen and lets the platform refuse. The platform refuses regardless of the rail.
| Area | Screen | Needs |
|---|---|---|
| Work | Match review and other queues | mdm:read to see; mdm:steward to decide |
| Work | My tasks | mdm:read |
| Work | Running workflows | mdm:read |
| Work | Change requests | mdm:steward |
| Records | Search, browse a record | mdm:read |
| Records | Bulk import, Taxonomy | Not gated by the rail; writes need the class the action needs |
| Records | Reference data, Hierarchies | mdm:read |
| Legal operations | Party register, Registry verification | mdm:read |
| Legal operations | Retention | Not gated by the rail |
| Legal operations | Timekeepers (read, write) | Read: mdm:read · record an admission, assignment or rate: mdm:steward · record a leaver: mdm:admin |
| Model | Entities, Data model, Attributes and forms, Workflows, Workflow definitions | Open to read; the controls inside need mdm:admin or mdm:steward as each screen says |
| Model | Survivorship, Match thresholds | mdm:read |
| Model | Workflow routing | mdm:admin |
| Insight | Dashboards | Not gated by the rail |
| Insight | AI suggestions | mdm:read |
| Administration | Everything under it — Console, Roles, People and access, Walls, Access review, Settings, Connections, Integration, AI models | mdm:admin |
"Not gated by the rail" does not mean "open to everyone"
It means the rail makes no claim either way. The platform decides on each read, and a screen that your roles cannot reach says Your roles do not reach this and gives the platform's reason.
Actions on a record
| Action | Needs |
|---|---|
| Open, search, browse, read history | mdm:read |
| Propose a change / Propose a new record | mdm:read (as a proposal) |
| Edit record / New record (direct) | mdm:steward |
| Approve or reject a change request | mdm:steward, and not the person who proposed it |
| Merge, reverse a merge, pin a value | mdm:steward |
| Export (Excel, CSV) | mdm:extract, and the role's permission over that entity |
| Resolve a source key | mdm:xref |
| Anything under Administration | mdm:admin |
What no class gives you
mdm:admindoes not read the firm's records. It is a role, not a bypass.- No class overrides an ethical wall. A wall is applied after every privilege and removes records unconditionally.
- Raising or approving an administrative change (a role catalogue, a wall, a pairing) needs a second administrator; the first cannot finish it. See Two-person approvals.