Groups

A group assigns datasource credentials to a team of users, such as Finance or Sales. A user's role defines their product permissions separately.

One datasource, different access

Maintain one datasource and its shared context: catalog descriptions, joins and business definitions. The datasource can have several credentials, each holding its own database identity and connection details, such as a connection string or service-account key.

For example, the same warehouse datasource can have Sales reader and Finance reader credentials. Assign each to its respective group. Sales and Finance use the same datasource and context, but their queries run with different database permissions.

Configure restrictions on tables, schemas, views or rows in your database. Groups determine which credential someone uses; they do not define those database restrictions. Shared context does not grant access to the data it describes.

Group settings

Open Settings > Groups and select a group.

Tab	What it controls
Members	Add or remove workspace users. People can belong to several groups.
Datasources	Choose one credential per datasource, or No access.
Settings	Rename or delete the group.

Names must be unique across groups and roles, ignoring capitalization, and no longer than 128 characters. For the setup steps, see Control who can query which data.

Everyone and overlapping groups

Everyone means all workspace users. The first credential on a new datasource is initially assigned to Everyone, so review that assignment before restricting the datasource to particular groups.

People receive access from all their groups and Everyone. No access removes only the selected group's assignment; it does not cancel another assignment. Existing credential assignments to a role or directly to a person also count.

Deleting a group removes its memberships and credential assignments, including the group on pending invitations. Other sources of access remain.

Credential selection

Querying requires datasource permission and exactly one distinct authorized credential for that datasource. This applies to Admins too. Permission to manage credentials does not itself grant permission to query.

Effective credentials	Result
None	No authorized credential; assign one through a group or Everyone.
One	Querio uses that credential. Several assignments to the same credential are fine.
More than one	The query is blocked because Querio cannot choose between them.

For example, if Everyone uses Shared reader and Finance uses Finance reader on the same datasource, Finance members receive two credentials and cannot query. Remove the overlapping Everyone assignment, or give both groups the same credential if they should use the same database access.

Querio does not choose the credential marked Default or the one associated with the highest role. Explicit permission denials and existing datasource restrictions can also prevent access.

Access errors

Error	What to check
`Datasource access denied` (`403`)	The person's datasource permission.
`No authorized credential for this datasource` (`403`)	Whether a group or Everyone assigns a credential they can use.
`Multiple credentials are authorized for this datasource` (`409`)	Overlapping assignments to different credentials.

Datasources and credentials covers creating and updating connections. After changing access, have a group member query a table they should be able to read.

Explores and boards

Datasource access and sharing are separate settings. Use Share to give someone access to an Explore or board. Someone who needs to run its queries also needs the relevant datasource access.