Studio permissions

Last updated: November 12, 2026NIM service baseline: v7.0.1864

Settings · Access

Give teams the Studio access they need to review configuration, manage selected resources, or run approved operations.

At a glance

Open Configuration > Settings > Access to assign Studio permissions to NIM groups. Start with rights for an area, such as Filters or Jobs, then add resource exceptions when one filter, job, or App needs different access.

Before you startSign in as an administrator and identify the NIM group and members who need access. Only administrators can open the Access tab.

Expected resultGroup members can see and use the selected Studio areas, with resource exceptions applied where configured.

Verify accessUse a non-administrator member account to check an allowed action and an action that should remain unavailable.

Set group permissions

Choose a group, grant area rights, and save the configuration.

Configure a group →

Limit or extend one resource

Give a filter, job, or App permissions that differ from its area.

Set a resource exception →

Look up an area

Check available rights and what Execute allows before granting it.

Open the area reference →

Studio permissions are separate from access to run a published App.

Set the rights of a group

Configure Studio group permissions

Step 1 of 41. Choose a group2. Grant area rights3. Save changes4. Verify access

Select the NIM group

1. Open Configuration > Settings > Access.
2. In Groups, select the group to configure. Use the group filters to find it.
3. Confirm that the right-hand grid changes to Studio rights of 'group name'.

The administrators group is grayed out. Selecting it shows all rights checked, with no editable controls. Use a different group for delegated permissions.

For starting permissions, compare the built-in groups.

Choose what the group may do

1. Find the Studio area to delegate.
2. Select the required R, C, U, D, and E checkboxes. Read is selected automatically when another right is granted.
3. For a complete reset of one area, use Quick set:
   • No access clears every right in that area.
   • Full access selects every right that applies to that area.
4. Hover over an area name in Studio to check what Execute means and any warning. Use the area reference to compare areas.

Review permissions that change other systems

Execute on Mapping and Jobs can write to target systems. App actions run with service rights and can change target systems, send mail, and start workflows. Review the intended outcomes before delegating these areas.

Check: use the right definitions to grant only what the task needs. A group that needs to inspect a filter may not need to change it or run a job.

Save before changing groups

Select Save at the top of the page. An asterisk (*) means the selected group has unsaved changes. Use Revert to discard those changes deliberately.

Changing groups discards unsaved changes

Save before selecting another group. Switching groups discards the current group's unsaved changes.

Check the member experience

1. Confirm that the intended user belongs to the configured group in NIM's Internal system.
2. Use a non-administrator member account to open Studio and review the permitted areas.
3. Check a permitted operation with controlled data, and confirm that an operation outside the intended scope is unavailable.
4. If access is broader or narrower than expected, review the user's other group memberships and any resource exceptions.

For MCP clients, also check NIM MCP rights; the account's Studio permissions alone do not determine the request's effective access.

Step 1 of 4

Give a resource rights of its own

By default, a group's area rights apply to every resource in that area. Use an exception when one filter, job, or App needs different permissions.

Configure a resource permission exception

Step 1 of 41. Select a resource2. Choose the mode3. Grant and save4. Review or remove

Add the exception

1. Under Resources with rights of their own, select Add.
2. In Kind, choose the resource type, such as filter, job, or app. Type to search the list.
3. In Resource, select the resource. Only resources of that kind without an existing exception appear.
4. Review the Access window that opens for the selected resource.

Add to or replace area permissions

Mode	Effect
Add to the area rights	The selected groups receive additional rights on this resource, on top of their area rights.
Replace the area rights	Only the selected groups have rights on this resource, and only the rights listed in the exception. Other groups lose their area rights on this resource.

For example, use an added right to let a group update one filter. Use replacement when a sensitive job should be available only to explicitly selected groups.

Replacement affects groups you do not select

Review who still needs access before choosing Replace the area rights. Groups omitted from the exception lose their area access to that resource. Administrators retain full Studio rights.

Set permissions for the resource

1. Under Rights on this kind, select each group's required rights.
2. Compare Area rights with the resource rights you are setting.
3. Select Save.

Create is unavailable here because it belongs to an area, not an existing resource. The administrators group is not listed because administrators always retain every Studio right.

Maintain the exception

Review the resource-exception grid and verify access with a non-administrator member of each affected group.

• To change an exception, select its edit icon under Actions.
• To remove it, select its delete icon, or open the exception and select Follow the area.

After removal, the resource follows its area's permissions again. Check that this is the intended result before removing a restrictive exception.

Step 1 of 4

How access works

Principle	What it means
Assign rights to groups	Users receive rights through their NIM group memberships. Rights from multiple groups add together.
Read comes first	Without R, a group cannot see an area. Selecting another right also selects R; clearing R clears the other rights in that area.
One readable area enables Studio access	A user with Read in at least one area can sign in to Studio. The interface shows only readable areas and permitted actions; the service also checks every request.
Area rights are the starting point	Resources follow their area's rights unless a resource exception adds to or replaces them.
Administrators keep full Studio rights	Members of the administrators group always have every right. The Access tab cannot restrict them. MCP requests have an additional NIM MCP permission limit, including for administrators.

Administrator-only settings

An area that is not listed on the Access tab cannot be delegated. License, Certificates, Maintenance, Preferences, Anonymization, SAML, LDAP, Version, Access, and HTTP(S) remain administrator-only Settings tabs.

The rights

Each area supports up to five rights. An empty cell means that right does not apply to the area.

Right	Name	Allows a group to…
R	Read	Open the area and view its resources.
C	Create	Add resources in the area.
U	Update	Change and save existing resources.
D	Delete	Remove resources.
E	Execute	Run an operation. The meaning depends on the area; see the area reference.

Built-in groups

Use these starting points when their permissions fit the task. NIM creates them when they do not already exist and shows Built-in in the Kind column. Their rights can be changed like those of other groups.

Group	Starting permissions	Typical use
NIM Light Admins	Every available right in every area, excluding administrator-only settings.	Configure NIM without full administrator membership.
NIM Auditors	Read in every area, with no change or execution rights.	Review configuration.
NIM Operators	Read and Execute in Systems, Jobs, Scheduler, and Audit queries.	Run collects, jobs, tasks, and queries without changing configuration.
NIM MCP	Limits every MCP session in addition to the account's own rights; the lesser access wins. This group has no members.	Control what connected AI clients may do. See MCP authorization.

The areas

Expand the relevant group to compare the available rights and execution behavior. In Studio, hover over an area name for its Execute description. ⚠︎ marks an area with a warning about actions beyond Studio.

Rights: R = Read, C = Create, U = Update, D = Delete, E = Execute. A checkmark means the right is available; a dash means it does not apply. These are available rights, not the permissions currently assigned to a group.

Systems, data, and automation

Area	R	C	U	D	E	Execution and restrictions
Systems	✓	✓	✓	✓	✓	Collect, view table data. Also covers tables and config scenarios (user store).
Relations	✓	✓	—	✓	✓	Preview results. Inter-system relations cannot be changed; delete and recreate them.
Filters	✓	✓	✓	✓	✓	Run the filter (shows data)
Name generation	✓	✓	✓	✓	✓	Filter preview (shows data)
Password generation	✓	✓	✓	✓	✓	Filter preview (shows data)
Mapping ⚠︎	✓	✓	✓	✓	✓	Filter preview, Run tab. Execute writes to target systems.
Roles	✓	✓	✓	✓	✓	Results/Members tab, group membership reports. Covers roles, role models, role generators, and role miners.
Jobs ⚠︎	✓	✓	✓	✓	✓	Evaluate/execute a job. Execute writes to target systems.
Audit queries	✓	✓	✓	✓	✓	Run a query (shows data)
Scheduler	✓	✓	✓	✓	✓	Run a scheduler task

Apps, self-service, and workflows

Area	R	C	U	D	E	Execution and restrictions
Apps ⚠︎	✓	✓	✓	✓	—	App actions run with service rights: they write to target systems, send mail, and start workflows. Also covers App settings, item libraries, images, and background images.
Onboarding	✓	✓	✓	✓	—
Password reset	✓	✓	✓	✓	—
Diagrams	✓	✓	✓	✓	—
Workflows	✓	✓	✓	✓	—	Workflow configurations.

Events, settings, and administration

Area	R	C	U	D	E	Execution and restrictions
Events – Actions	✓	✓	✓	✓	—
Events – Filters	✓	✓	✓	✓	—
Events – Templates	✓	✓	✓	✓	✓	Test notification.
Settings – Mail, SMS, preferences	✓	—	✓	—	—	Opens Mail and SMS. Update permits SMS changes and a test email. Only administrators change mail settings.
Settings – Connectors	✓	✓	✓	✓	—	Connectors tab.
Settings – Repositories	✓	✓	✓	✓	—	Repositories tab.
Settings – Snapshots	✓	✓	✓	✓	—	Snapshots tab.
Settings – Lookup tables	✓	✓	✓	✓	—	Lookup Tables tab.
Variables	✓	—	—	—	—	Variable names only; changes remain administrator-only.
Validation	✓	—	—	—	—
Scripts	✓	—	—	✓	—	Creation and changes remain administrator-only.
Log	✓	—	—	—	—

Grid reference

The Groups grid

Columns and group filters

Column	Shows
Group	Group name.
Kind	Administrators for the administrators group, Built-in for NIM-created groups, or empty for other groups.
Areas	Number of Studio areas in which the group has rights.

The administrators group is grayed out and cannot be edited. The list controls are:

• All groups shows every group and clears the other two filters.
• No app groups hides App-access groups whose names start with nga_.
• With rights shows groups with area rights or resource-specific rights.

No app groups and With rights can be combined. The selected group always remains in the list.

The Studio rights grid

Columns and selection state

Until a group is selected, the title is Studio rights (select a group) and every right is disabled.

Column	Shows
Area	Studio area. Hover for the Execute description and any warning.
R, C, U, D, E	The selected group's rights in the area.
Quick set	No access and Full access for that area.
Exceptions	Number of resources with their own rights, listed under Resources with rights of their own.

The Resources with rights of their own grid

Exception columns and actions

Column	Shows
Area	The resource's area.
Kind	Resource type.
Resource	Resource name.
Mode	Adds to area or Replaces area.
Groups	Each group's rights, such as NIM Operators RE, or nobody.
Actions	Edit or remove the exception.

Recommendations

• Start with a built-in group when its starting rights match the task, then review the actual saved permissions.
• Check other group memberships when access is broader than expected: group rights add together.
• Review replacement exceptions when a resource is unexpectedly unavailable.
• Use With rights during an access review, and verify both area rights and resource exceptions.
• Check additional restrictions for MCP clients, mail settings, and export destinations.

Report a problem with this page

Found an error or a missing step? Open the feedback form and describe what needs changing. The article details and Documentation topic are filled in for you.

Need help with your NIM environment? Contact Support.