--- title: "Grant warehouse access by role from the ยท Agent Wranglers" url: https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/warehouse-roles id: DEN-28 level: Recommended updated: 2026-10-22 tokens: 769 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Grant warehouse access by role from the directory For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Access and BI tools](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22. - ID: DEN-28 - Level: Recommended - Chapter: [Access and BI tools](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools.md) - Rule: Give people access to the warehouse and BI tools through roles kept in code and synced from the company directory. Grant nothing to a single person on a single table. - Check: A listing of warehouse grants shows no grant to a single user. Disable a test user in the directory. Within an hour, they can sign in to neither the warehouse nor the BI tool. - How: Sign people in through the company's identity provider, as [Sign people in through single sign-on](https://agentwranglers.se/playbook/infrastructure/identity-and-access/single-sign-on-for-people.md) says. Then leaving the company ends access, as [Remove access within a day of leaving](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day.md) requires. Keep a short list of roles, such as analyst, finance and engineer, in code as [Keep roles as code](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/roles-as-code.md) does. Review the members every quarter, as [Review access every quarter](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/access-reviews.md) says. ## Sources - [NIST SP 800-53 Rev. 5, AC-2 Account Management](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) ## Related rules - INF-16 [Sign people in through single sign-on](https://agentwranglers.se/playbook/infrastructure/identity-and-access/single-sign-on-for-people.md) in Infrastructure and environments - CMP-30 [Remove access within a day of leaving](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day.md) in Compliance and governance - CMP-32 [Keep roles as code](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/roles-as-code.md) in Compliance and governance - CMP-29 [Review access every quarter](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/access-reviews.md) in Compliance and governance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers data engineering playbook`. In code you write, add a comment next to it with the same link. - Next: [Mask personal columns for everyone outside a named role](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/column-masking.md) - [Access and BI tools](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools.md)