The default roles listed on this page are the out-of-the-box defaults from Palantir. Your administrator may have configured custom settings for your environment via custom role sets.
This page describes the operations that govern what you can do with Foundry Iceberg tables. Operations are the individual permissions Foundry checks before allowing an action, and roles are collections of operations that you can grant to users. For more information about how operations and roles relate, see Understanding roles and operations.
The broader table:read and table:write operations govern reading and writing Iceberg tables. These operations apply to both Iceberg tables and virtual tables.
Main branch protection support for Iceberg tables is in Beta and may not yet be available on your environment.
If you have main branch protection enabled on your Iceberg table resource, you must have the following operation to make changes outside of the owning Foundry job spec.
Foundry generates the job spec automatically from the pipeline that authored the table, such as the Pipeline Builder or Python transforms logic that created the resource. To make changes outside of this owning resource, you must have an additional elevated permission that bypasses the table's main branch protection.
| Operation | Display name | Default role |
|---|---|---|
iceberg:bypass-branch-protection | Bypass branch protection | Owner |
You commonly need this operation to make changes to a branch-protected table from either a maintenance task or an external client.
Main branch protection refers specifically to resource branch protection on the table, and not to code branch protection on the backing code.
These operations control who can read and write maintenance tasks on an Iceberg table.
| Operation | Display name | Default role |
|---|---|---|
iceberg:read-maintenance-tasks | Read table maintenance tasks | Viewer |
iceberg:write-maintenance-tasks | Write table maintenance tasks | Editor |
iceberg:write-sql-maintenance-tasks | Write custom SQL maintenance tasks | Editor |
iceberg:write-data-altering-maintenance-tasks | Write data-altering maintenance tasks | Editor |
iceberg:schedule-maintenance-tasks | Schedule maintenance tasks (of any type) | Editor |
The three write operations are cumulative. Writing or editing any maintenance task always requires iceberg:write-maintenance-tasks. Depending on the task category, Foundry also checks the more specific iceberg:write-sql-maintenance-tasks and iceberg:write-data-altering-maintenance-tasks operations. As a result, removing iceberg:write-maintenance-tasks from a role removes the ability to author maintenance tasks entirely, even if the role still includes the other two operations.
Creating or editing a task also requires permission to read and write the underlying table data. On a branch-protected table, main branch protection applies as well.
The following table shows the operations you need to write each kind of task:
| Task type | Required operations |
|---|---|
| Form-based procedures: For example, Rewrite data files or Expire snapshots | iceberg:write-maintenance-tasks |
Custom SQL that does not logically alter the current snapshot:For example, CALL system.rewrite_data_files(...) | iceberg:write-maintenance-tasks+ iceberg:write-sql-maintenance-tasks |
Custom SQL that logically alters the current snapshot:For example, INSERT, UPDATE, DELETE | iceberg:write-maintenance-tasks+ iceberg:write-sql-maintenance-tasks+ iceberg:write-data-altering-maintenance-tasks |
Foundry checks the operation to bypass main branch protection and the operations to edit maintenance tasks independently. This lets you separate who can author a kind of change from the tables they can apply it to.
For example:
iceberg:write-sql-maintenance-tasks and iceberg:write-maintenance-tasks.iceberg:bypass-branch-protection.