Administration

This section is for administrators and security stewards who manage who can access what in VDA. Most tasks are done from the Access Management page and require Administrator or Security Steward privileges.

Access control

Task	Where	Guide
Review what a role can do, and add or remove ALLOW/DENY rules	Access Management → Role Permissions (PBAC)	Managing Role Permissions
Draft or audit rules with an LLM	Role Permissions → AI Policy Assistant	AI Policy Assistant
Test a rule before it affects users	Access Management → Access Simulator & Audit	The Permission Simulator
Understand how rules are evaluated	n/a	Zero-Trust Security & PBAC Engine

Good practice

Run every new rule through the simulator for the roles it affects. Explicit DENY rules always win, so a single column-level deny can override a broad ALLOW.

Identity and roles

Users sign in through your enterprise identity provider (Keycloak, Okta, or Azure AD). VDA reads the user's roles from the identity provider and applies the PBAC rules bound to those roles. Roles themselves are managed in the identity provider.

Datasources

Connect and manage sources from the Datasources page. See Data Catalog & Discovery for how connected sources appear to users.

API keys and AI agents

Users generate their own API keys for scripts and AI agents. Keys inherit the user's role, can be limited to specific datasources, and can expire or be revoked at any time. The full key is shown once and only a hash is stored. See MCP & AI Agent Integration.

Auditing

Access decisions and policy changes produce structured JSON audit events that can be forwarded to a SIEM such as Splunk, Elastic, or QRadar. See Enterprise Audit Logging.

Installation and operations

Installing, sizing, and operating VDA is covered in Installation & Operations.