A complete solution for open data platforms, enterprise data catalogs, data lakes and data management. Open source, mature, fully-featured and production ready.

DataHub

Hi All,
We are working on having Domain specific role for the Editors so that they can add/edit/delete all objects they own and view access the rest of them. But there's `Editor - Metadata policy` which is not editable and comes with the default source package. It gives *Editors* All privileges even on the objects which they don't own. We have managed to make this policy editable and deactivate it via update query on the DB. (query is in the thread). The problem which we are facing every time the POD restart it re-loads the default policies from `policy.json` overwriting our updated value. Is there a trick where I can either
1. Deactivate `Editor - Metadata policy` policy by default
2. Make `Editor - Metadata policy` editable
Note : I am trying to avoid for forking out a new project from and build a new custom image just for this tiny config change.

```update metadata_aspect_v2 set metadata='{"actors":{"resourceOwners":false,"groups":[],"allUsers":false,"allGroups":false,"users":[],"roles":["urn:li:dataHubRole:Editor"]},"privileges":["VIEW_ENTITY_PAGE","EDIT_ENTITY_TAGS","EDIT_ENTITY_GLOSSARY_TERMS","EDIT_ENTITY_OWNERS","EDIT_ENTITY_DOCS","EDIT_ENTITY_DOC_LINKS","EDIT_ENTITY_STATUS","EDIT_DOMAINS_PRIVILEGE","EDIT_DEPRECATION_PRIVILEGE","EDIT_ENTITY_ASSERTIONS","EDIT_ENTITY","EDIT_DATASET_COL_TAGS","EDIT_DATASET_COL_GLOSSARY_TERMS","EDIT_DATASET_COL_DESCRIPTION","VIEW_DATASET_USAGE","VIEW_DATASET_PROFILE","EDIT_TAG_COLOR","EDIT_GROUP_MEMBERS","EDIT_USER_PROFILE","EDIT_CONTACT_INFO","MANAGE_ENTITY_TAGS_PRIVILEGE","MANAGE_ENTITY_GLOSSARY_TERMS_PRIVILEGE","MANAGE_DATASET_COL_GLOSSARY_TERMS_PRIVILEGE","MANAGE_DATASET_COL_TAGS_PRIVILEGE","EDIT_ENTITY_ASSERTIONS_PRIVILEGE"],"displayName":"Editors - Metadata Policy","editable":true,"description":"Editors have all metadata privileges.","state":"ACTIVE","type":"METADATA"}' where urn = 'urn:li:dataHubPolicy:editor-metadata-policy' and aspect='dataHubPolicyInfo' and version=0;```

Settings --&gt; Permissions --&gt; Policies

hey Deepak! so there's not going to be an easy way to deactivate the policy or make the policy editable without forking as the way things stand right now. We tried to be opinionated on how these roles work, but for custom configuration, we would suggest creating your own policy and applying it to people through something like groups if you only want a subset of users to be able to edit entities that they own.

we also plan on adding the ability to allow users to create custom roles for a situation like this where you want to apply policies based on a role instead of a user group. however this isn't on the immediate roadmap so I can't guarantee when that will happen

Just curious <@U03BEML16LB> if I update the value via python sdk (emit a new aspect to that policyUrn) will gms overwrite it (as it's one of those default policies) again when starting up a new pod or something?

unfortunately that's the case I believe. on boot up we re-ingest default policies in order to set what we expect at least on pod start