Hello. Our company are about to deploy datahub for managing metdata of our databases. Since we are pretty strict about secuity, what we want is to prevent staffs who are just readers from ingesting databases by him/herself. In short, those who have no authority about database managing should not "create new source" in the "manage ingestion". How can I do this?

there shd be a platform privilege

manage metadata ingestion

that you should not grant to all your users, only selected folks

maybe default rule is that only admin can ingest.

Thanks for applies. I guess giving restriction of ingestion is not possible in UI. @better-orange-49102 may mention API-based method. right? And one question of your answer, @white-xylophone-3944 . You mean, users who are editor or reader can't ingest, aren't they? But I've checked reader can finish ingestion process..

By right, if you disable the platform privilege, they should not be able to access the menu to do UI ingestion.

maybe you can set in settings - permissions - policies

Now I got it. I saw policies after changing the account with adiministrator. One more question : our security team wants the information about ingestion tab not revealed to users who are not privileged since anyone can see information about db account and its password. To do this, is it sufficient to make new policies restricting "data tasks"?

I'm not certain. I know GraphQL has some queries pertaining to ingestion tasks. But not completely certain they'll check for the manage ingestion privileges. I recall someone mentioning you can retrieve the tasks from there.

I cant know surely, how about using cli ingest. It can't edit it in web

@average-dinner-25106 Are you still curious about the policies here? Have you checked out the Policies guide here: https://datahubproject.io/docs/authorization/policies

Thanks guys!! Your replies are helpful a lot!