Restrict Build Permissions for a Transform

Ask the Community
,
1

hi deltas! was wondering if anyone knows how to restrict build permissions for a specific transform? we have a transform that writes back to one shared drive across dev stage and prod spaces and want to restrict permissions to write back to only prod

2

Hey Ishavasil! There’s no per-transform build permission in Foundry, it is controlled at the project level instead. Here’s how to lock writeback to prod only:

  • A transform can only write to datasets in the same project as its code repo, otherwise you get AccessOutsideProjectDenied.
  • Access to write is really just the Editor+ role on the project containing the output dataset (Viewer/Discoverer can’t trigger writes).
  • Put the shared drive output in its own prod project, separate from dev/stage.
  • Grant Editor on that prod project only to whoever should run prod builds, ideally a group (e.g. prod-pipeline-editors) rather than individuals.
  • Give dev/stage users Viewer at most on the prod project - they can read the output but can’t write to it.
  • If you need the same code to run in dev/stage, create separate output datasets per environment, each in its own project, so dev/stage builds can never touch the prod dataset.

So bottom line: restrict Editor access on the prod project, that’s your actual lever here, not a per-transform setting.

Thanks!