Hey everyone, I had a question regarding access management (mostly in dbt). Up till recently, I was the only person on our dbt project. This has changed, and we're now 4 people on the same project - issue is, we don't all have the same level of access (I'm the only person with access to payroll). This means that if they do a simple

dbt run

or if they try to materialise a model based on payroll, it will fail. My question is: how do you manage users having access to "aggregated" views that depend on sensitive data in dbt, making it so that they can still use

dbt run

with no issue.

I think you have to train them on which models they’re able to select and work from. At a certain point you won’t be able to do a full

dbt run

any more and you’ll have to run subsets of the dag

Thanks for the answer @taylor 😄 Yes I was guessing there would be a portion that would just have to be implementing best practices. This case though is a bit more tricky - we use the payroll to calculate human costs associated to a project (salary * hours spent). Therefore, the aggregated values are super important, but not necessarily the raw data. Would there be a way to give them access to the aggregated values only without having access to raw data?

I always managed that via permifrost. At the end of a dbt run I would run some grants to particular user roles. https://about.gitlab.com/handbook/business-technology/data-team/platform/#snowflake-permissions-paradigm gives some detail on it. but yes it’s possible, you just have to set it up so you can have more fine-grained permissioning

Ok awesome, thank you so much!

I don’t know if there is any 😞

https://docs.getdbt.com/reference/resource-configs/bigquery-configs#authorized-views Trying to see if authorized views would work, but not sure how to set them up