Use this reference before granting access or transferring a Data task. The table distinguishes ordinary reference tables from the WooCommerce SKU template. It also distinguishes a browser role from a connection's approved source and reader grants. A broad menu or route does not remove the task's more specific authority check.
Read the permission terms
OR means either listed effective role is sufficient. AND means the same person needs both permissions for the combined task. Another reviewer means a different eligible individual. Current Accounts grants and site assignments can narrow the role a person appears to hold.
Recent verification means an Accounts second-factor check from the last five minutes where stated. Ordinary reads and table edits do not automatically require a new five-minute check. General session verification, current source/version, recovery and connection admission still apply. Connected features may be unavailable at a site even with the named role.
Match the task to its authority
| Task | Who | Additional conditions | Related guide |
|---|---|---|---|
| Read Reference tables or Shop connections | Any of the six product roles | Exact real-site permissions for shops and permitted current record scope. Reading is not authority to edit a table or decide an order. | Viewer |
| Read External sheets, Test a query, Refresh history or Data feeds | Owner OR Operator OR Viewer | Author, Reviewer and Supervisor alone do not inherit these generic reader roles. | Queries |
| Create an ordinary custom/customer-product reference table | Owner | Recent verification. Column schema and identity choices need checking before creation. | Create a table |
| Edit or save an ordinary reference-table version | Owner OR Operator | Current saved revision, reviewed preview, reason and explicit removal acknowledgement. Author alone cannot edit this ordinary template. | Edit a table |
| Create or edit the WooCommerce SKU mapping table | Author | This specific template has Author authority. Its saved version is still not an active shop mapping release. | Shop mappings |
| Register an external sheet | Owner | Recent verification; one exact spreadsheet/tab pair. Registration does not contact Google or schedule refresh. | External sheets |
| Preview or accept an external snapshot | Owner OR Operator | The accepted snapshot replaces its parameters and all rows together. Failed receive preserves the last good snapshot and failure state. | External sheets |
| Run an ad-hoc query | Owner OR Operator OR Viewer | Current source access and typed exact matches; it creates no reusable rule approval. | Queries |
| Prepare a saved selection through the visible source-selection page | Author AND one of Owner, Operator or Viewer | Author creates the definition, while the page itself requires a generic reader role. Source preparation alone is not publication. | Saved selections |
| Run a released selection in the browser | Owner OR Operator OR Viewer | Exact published unit, approved sources, current source validity and native holds. | Saved selections |
| Run a released selection through a connection | Valid read credential for the source | Its exact key must be an approved reader of the selection AND its source must be approved. The connection sees only that one source, not all selected sources. | Saved selections |
| Create a feed | Owner | Recent verification and supported source-role bindings. Reviewed source-selection policies retain their separate release workflow. | Feeds |
| Preview a feed or download its retained file/evidence | Owner OR Operator OR Viewer | Correct feed and current preview or retained run. A downloaded file has not been accepted by KitProof merely because it exists. | Feeds |
| Generate a new feed file | Owner OR Operator | Real site and current reviewed preview. Viewer does not generate new runs. | Feeds |
| Prepare a supported LabelRules export | Owner OR Operator OR Viewer | Supported customer-product schema, one saved version and verified export settings. No automatic receiving import or printing. | LabelRules export |
| Save a shop mapping draft | Author | Exact saved SKU version and independently expected examples. Source-version authorship remains part of review independence. | Shop mappings |
| Preview a shop mapping release | Reviewer | Read all required comparison pages and complete expected outcomes. | Shop mappings |
| Activate a shop mapping | Reviewer | Recent verification. Reviewer must differ from both mapping author and saved source-version author. Enrolled native publication checks cannot be bypassed. | Shop mappings |
| Read an order again, resend refused lines or replay retained delivery | Operator | The action must be offered for the current connection/order state. Supervisor alone is not Operator. Retained-event replay preserves original identity and bytes. | Shop orders |
| Decide a binned/deleted order's deduction | Supervisor | Recent verification and reason. Keep or reverse is queued for authoritative reconciliation; a permanently deleted order's recorded decision is final. | Shop orders |
| Configure, check, start or manage the shop connection | Owner | Recent verification, current connected-mode checks and independently activated mapping. This does not give Author or Reviewer authority. | Application access |
| Create/revoke temporary application credentials | Owner | Recent verification. Credentials remain tied to the issuing Owner's current Accounts session, source and abilities; they are not unattended production credentials. | Application access |
| Enrol an observation producer or withdraw an observation | Owner | Recent verification, exact source-bound contract and original-request recovery. Revocation and withdrawal have different effects. | Source observations |
| Review or activate protected shop retention | Owner | Recent verification for activation and the fixed policy's current protected-work checks. Other roles do not receive the Owner review data. | History and recovery |
| Download the complete site export | Owner | Real site and recent verification; the private read-only snapshot is not a restoration backup. | History and recovery |
Keep role and source grants separate
An Author wanting to create a saved selection from its browser page needs Author AND a generic reader role. SKU-table authoring requires Author. It grants no permission to edit ordinary reference tables. Someone responsible for both order read/replay and deduction decisions needs Operator AND Supervisor.
A connection's read ability is not a grant to every source or selection. Current issuing-session authority, source binding, approved reader identity, revocation and recovery generation are checked separately. Reviewed rule publication does not widen that credential. For Automation-managed changes, arrange the appropriate Author and independent Reviewer in Automation and the native product as well.