# Snowflake Role Reference

The named roles, what each can read and write, and which warehouses each may use. PHI versus de-identified access is gated by role — each user gets the least-privileged role that still does the job.

## Role hierarchy

```text
NDP_RWD_DOMAIN_ADMIN_ROLE (human admins + service users)
 └── RWD_DATA_ENGINEER_ROLE (engineers + dbt service user)
      ├── RWD_ANALYST_PHI_ROLE
      │    └── RWD_RESEARCHER_PHI_ROLE
      │         └── RWD_VIEWER_PHI_ROLE
      ├── RWD_ANALYST_DEID_ROLE
      │    └── RWD_RESEARCHER_DEID_ROLE
      │         └── RWD_VIEWER_DEID_ROLE
      ├── RWD_NOTEBOOK_USER_ROLE (add-on)
      └── RWD_STREAMLIT_DEVELOPER_ROLE (add-on)
```

Roles inherit downward: a Data Engineer has all permissions of Analyst, Researcher, and Viewer combined.

## Role selection guide

| User type | Recommended role | Reasoning |
| --- | --- | --- |
| BI consumer (dashboards only) | `RWD_VIEWER_PHI_ROLE` | Read-only on LIMS_COHORTS + DASHBOARD only. |
| Researcher / scientist | `RWD_RESEARCHER_PHI_ROLE` | Read all curated data; interactive warehouse. |
| CDO analyst / power user | `RWD_ANALYST_PHI_ROLE` | Everything plus staging, Cortex AI, scratch write. |
| Data engineer | `RWD_DATA_ENGINEER_ROLE` | Everything plus ETL warehouses, OPERATE/MONITOR. |

## Permissions matrix

| Capability | Viewer | Researcher | Analyst | Engineer |
| --- | :---: | :---: | :---: | :---: |
| LIMS_COHORTS / DASHBOARD (SELECT) | ✓ | ✓ | ✓ | ✓ |
| LIMS_PUB foundation (SELECT) | — | ✓ | ✓ | ✓ |
| VARIANTS (SELECT) | — | ✓ | ✓ | ✓ |
| Staging schemas (SELECT) | — | — | ✓ | ✓ |
| Cortex AI features | — | — | ✓ | ✓ |
| RWD_ANALYTICS (write) | — | — | ✓ | ✓ |
| ETL warehouses (OPERATE) | — | — | — | ✓ |
| CREATE ROLE, manage users | — | — | — | — |

> **Manage-users is admin-only**
>
> `CREATE ROLE` and user management belong to `NDP_RWD_DOMAIN_ADMIN_ROLE` only — above the engineer tier shown here.

## Warehouse access by role

| Warehouse | Viewer | Researcher | Analyst | Engineer |
| --- | :---: | :---: | :---: | :---: |
| QUERY_INTERACTIVE_WH | — | USAGE | USAGE | USAGE |
| QUERY_ANALYTICS_WH | — | — | USAGE | USAGE |
| BI_WH | USAGE | — | — | — |
| AI_WH | — | — | USAGE | USAGE |
| ETL_TRANSFORM_WH | — | — | — | USAGE + OPERATE |

> **Source of truth**
>
> The RBAC YAML in `ndp-account-request` defines roles, inheritance, user assignments, and warehouse grants. Query the production file to confirm current rosters; do not rely on counts pinned in docs.