Apache Superset Permissions: Smarter Access Control -
Apache Superset offers flexible permissions, but default role configurations often lead to excessive
privileges and manual dataset access management.This guide explores scalable permission design for
multi-department deployments in Superset 3.x and 4.x.
Understanding Superset Permissions
Superset uses Flask-AppBuilder’s security model, built on three concepts:
Permission: Actions such as can_read, can_write, can_export, and schema_access.
View Menu: The resource being accessed, such as a Dashboard, Chart, Dataset, or SQL Lab.
Permission View: The combination of an action and a resource, grouped into roles assigned to users.
Key principles: Roles are composable, combining capabilities and data access, but there is no deny
override—any role granting dataset access makes that access available.
Dataset vs. Schema Permissions
Superset creates dataset-specific permissions automatically, expanding the permission list as the catalogue grows.
Schema-level schema_access provides a scalable alternative, covering all current and future datasets
within a schema.
