> For the complete documentation index, see [llms.txt](https://knowledgebase.fabricdata.com/studio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.fabricdata.com/studio/admin-and-configuration/security/getting-started.md).

# Getting Started

### Step 1: Create Roles

Navigate to **Security > Roles** and create job-function roles:

* Example: 'Metadata Editor', 'Localisation Reviewer', 'QA Analyst', 'Catalog Manager'

<figure><img src="/files/9WNG9fdGDGi08p4f9fMI" alt=""><figcaption></figcaption></figure>

A Role needs:

* **Name** (3–150 characters, unique, required)
* **Description** (optional)

A Role grants no permissions on its own—you'll link it to Policies next.

***

### Step 2: Create Permission Groups

Navigate to **Security > Permission Groups** and group your records.

Think of these as "who can see this set of records":

* Example: 'Thriller\_Portfolio' (all thriller titles), 'EMEA\_Region' (European, Middle Eastern, African titles)

Assign titles to groups via the Permission Groups interface. A record can belong to multiple groups.

***

### Step 3: Create Policies

Navigate to **Security > Policies**. Each policy specifies:

* **Actions:** Create, Read, Update, Delete (pick which ones)\
  ![](/files/yFzISrY8DAgcZ73mUeC5)
* **Work Types:** Movies, Series, Seasons, Episodes, Compilations (or any subset)\
  ![](/files/8XR797VQ22tTPLL4CQon)
* **Workflow Phases:** Drafting, Published (or both)\
  ![](/files/BS0S0qyOJFqUsZlq8OTd)
* **Data Groups:** Which fields are editable\
  ![](/files/EiUsUL2c37lnrQDftVb3)
* **Locales:** Which languages

A Policy is designed to be reused. One "Read-Only Reviewer" policy can be assigned to multiple Roles and Permission Groups.

***

### Step 4: Create Access Assignments

Navigate to **Security > Access** and link everything together:

1. Select one **Policy** (single-select)
2. Select one or more **Roles** (multi-select)
3. Select one or more **Permission Groups** (multi-select)
4. Select **Save**

The system creates one assignment per valid combination. (Example: 1 Policy × 3 Roles × 2 Permission Groups = 6 assignment rows)

Assignments take effect immediately. Changes to a Policy propagate instantly to everyone linked through it.\
![](/files/MiReLK78jopxLh2nw3Iu)

***

### Step 5: Assign Roles to Users

Navigate to **Administration > Users** and assign Roles to individual users.

A user must have a Role to get any access at all.

**Example:** 'Alice' is assigned 'Metadata Editor' + 'Localisation Reviewer'.\
Alice receives the union of permissions from both Roles.

**Limit:** Max 3 Roles per user.

***

### Pro Tips

* **Permissions are additive:** If a user has overlapping access through multiple roles, they get the union. The most permissive combination wins.
* **No deny logic:** You can only grant access through positive assignment. To restrict, remove the path that grants it.
* **Changes take effect immediately:** Update a Policy, and every user linked through it gets the new permissions instantly. No restart needed.
* **Renames propagate instantly:** Rename a Role, Policy, or Permission Group, and the change appears everywhere—Access, Users, filters. No reassignment needed.
* **A Role alone grants nothing:** Even if a user has a Role, they get access only if that Role is linked to a Policy in Access, and the Policy is linked to a Permission Group containing the records they need.

***

### Next Step

Set up complete? → Managing Access for ongoing tasks\
Need to verify setup? → Auditing & FAQ