Skip to main content
Every Beam pipeline config is governed by per-resource access control. Each user’s effective access on a config is derived from one or more roles granted directly to them or to a team they belong to. When you create a pipeline, you automatically become its owner, and every member of your team is granted read access to it.

​
Roles

Roles are granted on a per-config basis. A user can hold at most one user-level role per config; team-level roles stack with whatever the user already has.

​
Permissions

Each role resolves into a set of permissions that gate API behaviour: A user’s effective permission on a config is the union of every role they hold on it, directly or through a team.

​
Default access on a new pipeline

When a pipeline is created:
  1. The creating user is granted owner on the config.
  2. The creator’s team is granted team viewer, so every teammate gets read access automatically.
No other users or teams have access until an owner grants it.

​
Sharing a pipeline

Owners can grant additional access from the pipeline settings:
  • Add a user as editor or reader — gives that one user the corresponding permissions, independent of their team membership.
  • Add a team as viewer — gives every member of that team read access. Useful for opening up visibility to a partner team without listing individuals.