--- title: "Roles & Permissions — Each Team Sees Its Data Marts | OWOX" canonical: "https://www.owox.com/features/roles-permissions" updated: "2026-10-13" --- Roles & Permissions # One Project. Each Team Sees Its Own Data Marts. In a project shared by Marketing, Sales and Finance, an AI assistant can answer Sales with Marketing's conversion rate. Roles cap what members can do, Sharing on each Data Mart says who may report on it or change it, and Contexts decide which teams see it. [Get started free](https://www.owox.com/app-signup?utm_source=owox.com&utm_medium=website&utm_campaign=features&utm_content=hero) [Read the docs →](https://docs.owox.com/docs/project/roles-and-permissions/) Does this fit your stack? ![Roles & Permissions](https://cdn.owox.ai/www/portfolio-management-product-feature/roles-permissions/hero/1-2bkvdt.png/public) Why OWOX A Sales manager asks why the AI assistant's conversion rate is not the Sales report's, and you find it used Marketing's definition, from a Data Mart built for Marketing. Roles, Sharing on each Data Mart and Contexts decide who may change a Data Mart, who may report on it, and which teams, and their AI assistants, see it. * Tag Orders with Sales and Finance and scope a member to Finance: their AI assistant, connected through OWOX MCP, lists and searches the Data Marts tagged Finance, not Marketing's. So do the app and Google Sheets. * A Business User builds and runs reports on the Data Marts shared for reporting, in the app, Google Sheets and AI assistants, with no warehouse credentials; the definitions stay with the Data Owner. * Small team? Change nothing: a new Data Mart arrives shared for reporting and maintenance, and a project without Contexts works as before. ## Scoped by Team ## Everyone sees everything, or every request waits on you A Sales manager asks why the AI assistant's conversion rate is off: it read Marketing's definition. Without roles, everyone can edit every Data Mart, or every request is yours. An edit by someone unaware of what it feeds traces back to you. THE DATA OWNER ### Decide on the Data Mart, once On a Data Mart's Overview, name its Data Owner and Business Owner, then set two switches: Shared for reporting lets members see it and build reports on it; Shared for maintenance lets other Data Owners edit it. Tick the Contexts of the teams it serves. Who may use it and who may change it, written down. THE BUSINESS USER ### Open your team's Data Marts, not the company's A member scoped to Finance sees the shared Data Marts tagged Finance, in the app, in Google Sheets and in AI assistants connected through OWOX MCP. Build and run reports on them and own those reports. The Data Mart definitions stay with the Data Owner. Your team's list, without asking for each Data Mart. **Nothing written into your warehouse** — Warehouse GRANTs and row-level policies are SQL that only a DBA reads, rewritten whenever the org chart moves. Roles, Sharing and Contexts sit on the Data Mart the Data Owner already has open, and decide which Data Marts a team sees, not which rows. ## For Data Owners For Data Owners ## Access becomes a property of the Data Mart Who may change a Data Mart and who may report on it is set on the Data Mart itself, so the answer stops being a message thread with you. #### Three roles, one ceiling Project Admin manages members, Contexts and every resource. Data Owner builds and maintains Data Marts, Storages and Destinations. Business User reports on Data Marts shared for reporting and cannot create, edit or delete a Data Mart or a Storage, whatever else is set. #### Worked example: Orders for Sales and Finance As Project Admin, create Marketing, Sales and Finance in Project Settings → Contexts. On the Orders Data Mart's Contexts card, tick Sales and Finance. Set a Business User's Role scope to Selected contexts only, with Finance. Their Data Marts list shows Orders, still badged Sales. #### Defaults that fit a small team A new Data Mart arrives shared for reporting and for maintenance. A new Storage or Destination is shared for use only, since its maintenance switch also allows copying its credentials. Role scope defaults to Entire project, so a project without Contexts works as before. ## For Business Users For Business Users ## Start from the Data Marts your team reports on Which Data Marts you can build on is already decided on each one, so you open a short, relevant list instead of every Data Mart the company has built. #### Badged by team The Data Marts list shows each Data Mart's Contexts and filters by them. Orders carries Sales and Finance because both teams read revenue: a Context is a tag a Data Mart can carry several of, not a folder. #### The same list in Google Sheets and AI assistants The scope sits on the Data Mart, not on a dashboard folder. The OWOX Extension for Google Sheets reaches the same Data Marts you see in the app, and an AI assistant connected through OWOX MCP lists and searches only those. #### Your reports stay yours You own the reports and Destinations you create, and can edit, run or delete them. You work from the Data Marts themselves, with no warehouse credentials to hold; their definitions and the Storages stay with the Data Owner. ## Editions ## Compare plans Individual Your analyst, just for you. $295 / month [Try free](https://www.owox.com/app-signup) Team Your analyst for your leadership team. $790 / month [Book a demo](/book-a-call) Scale Your analyst for the whole company. Let's talk [Book a demo](/book-a-call) [See full pricing & comparison →](/pricing) ## Why teams pick OWOX ## Everything business needs ### Roles cap every permission A Business User never reaches maintenance on a Data Mart or a Storage, whatever the Sharing switches or Contexts say. ### Owners keep what they own A Data Mart's Data Owner and Business Owner always see and use it, whatever its Sharing switches or Contexts. ### Changes apply at once Attaching a Context shows its Data Marts to the members scoped to it immediately; removing it hides them immediately. ### No silent lockout on delete A Context still attached to Data Marts, Storages, Destinations or members cannot be deleted. OWOX lists what holds it, with a link to each. ## FAQ ## Frequently asked questions How is this different from row-level security? Row-level security filters rows inside a table through policies written in your warehouse. Roles, Sharing and Contexts decide which Data Marts, Storages and Destinations a member can reach; they do not filter rows or mask columns inside a Data Mart. Nothing is written into your warehouse, and the same scope holds in [Google Sheets](https://www.owox.com/product/spreadsheets) and in [AI assistants](https://www.owox.com/product/ai-assistants). What can a Business User do? Build reports on Data Marts shared for reporting, in the app, Google Sheets and AI assistants, and edit, run or delete the reports they own. Create Destinations and manage the ones they own. All of it works with no warehouse credentials: creating, editing and deleting Data Marts, Storages and connector triggers stays with Data Owners and Project Admins. Who decides what a Data Mart is shared for? A Data Owner of that Data Mart who holds the Data Owner role, or a Project Admin: Configure Sharing and Manage Owners belong to them. A Data Mart's Business Owner always sees and uses it, whatever the switches say, but does not change its Sharing. What does a member on Selected contexts only see? Shared resources that carry at least one of their Contexts, plus anything they own. Attaching or removing a Context changes what they see at once. With no Contexts assigned, they see nothing shared, so assign at least one. Project Admins bypass Contexts and see everything. How do colleagues get a role? A Project Admin sets each member's role and Role scope in Project Settings → Members. In an Organization's main project, colleagues on the corporate email domain can join automatically with the default role and scope the Project Admin chose, or request access and wait for approval. Public email domains are excluded. Do I have to set up Contexts? No. Role scope defaults to Entire project, and a new Data Mart arrives shared for reporting and maintenance, so a small team can change nothing. Reach for Contexts when one project serves several teams. Contexts belong to one project: a second project is set up separately. ## What users are saying ## Every claim has a receipt. Real things real customers said — each quote pinned to a specific claim, straight from the quotes database. A3 · re: trusting AI ![Nodari Rizun](https://cdn.owox.ai/www/webflow/6a7b298b2ca5055443187566_nodari-headshot.png/public) Nodari Rizun · Founder & CEO, Pürblack® > _“AI, by the nature of the models, will hallucinate. And because of that, you need something which will create guardrails to ensure that there are no hallucinations, that you can trust your data.”_ C9 · re: one source of truth ![Mark Simmons](https://cdn.owox.ai/www/webflow/6a7b298b2b9daab0ade631d7_mark-headshot.png/public) Mark Simmons · CMO, Pürblack® > _“We had six or seven different channels and no single source of truth — it was almost impossible, a lot of guesswork.”_ E7 · re: getting time back ![Nodari Rizun](https://cdn.owox.ai/www/webflow/6a7b298b2ca5055443187566_nodari-headshot.png/public) Nodari Rizun · Founder & CEO, Pürblack® > _“We regained time. And time is the one resource that never comes back.”_ ## Recent updates * [0.37.0 · Technical Owner and Technical User are now called Data Owner](https://docs.owox.com/docs/changelog/#technical-owner-and-technical-user-are-now-called-data-owner-0370) * [0.31.0 · New Data Marts are shared for maintenance by default](https://docs.owox.com/docs/changelog/#new-data-marts-are-shared-for-maintenance-by-default-0310) * [0.31.0 · Preview SQL no longer requires edit access](https://docs.owox.com/docs/changelog/#preview-sql-no-longer-requires-edit-access-0310) * [0.30.0 · Clearer permission errors when managing Storages, Destinations, and Data Marts](https://docs.owox.com/docs/changelog/#clearer-permission-errors-when-managing-storages-destinations-and-data-marts-0300) * [0.27.0 · User provisioning and project access requests](https://docs.owox.com/docs/changelog/#user-provisioning-and-project-access-requests-0270) ## Scope each team to its own Data Marts Create Contexts in Project Settings, tick them on the Data Marts each team reads, then set each member's Role scope. [Get started free](https://www.owox.com/app-signup?utm_source=owox.com&utm_medium=website&utm_campaign=features&utm_content=hero) ## References 1. Internal OWOX data as of 2026-10-02 2. [G2 reviews of OWOX](https://www.g2.com/products/owox/reviews) 3. [npm installs stat](https://npm-stat.com/charts.html?package=owox&from=2025-01-01&to=2028-01-01) ## Book a call You are booked. The invitation is on its way to , with the calendar invite and the meeting link. [Reschedule](#) [Cancel](#) ## Links Pages this page links to, on this site and on docs.owox.com. Where the page has a Markdown twin, its address follows the link. - [Get started free](https://www.owox.com/app-signup?utm_source=owox.com&utm_medium=website&utm_campaign=features&utm_content=hero) - [Read the docs →](https://docs.owox.com/docs/project/roles-and-permissions) - [Try free](https://www.owox.com/app-signup) - [Book a demo](https://www.owox.com/book-a-call) — /book-a-call.md - [See full pricing & comparison →](https://www.owox.com/pricing) — /pricing.md - [Google Sheets](https://www.owox.com/product/spreadsheets) — /product/spreadsheets.md - [AI assistants](https://www.owox.com/product/ai-assistants) — /product/ai-assistants.md - [0.37.0 · Technical Owner and Technical User are now called Data Owner](https://docs.owox.com/docs/changelog)