Share and Govern an Analytics Project

For: Workspace Owners

Use this page to grant or revoke Analytics Project roles, review active collaborators, and maintain Lab Project links. All governance operations are performed through your AI Agent and Culsma PAWS MCP; there is no Analytics Web/App permissions screen.

Grant, revoke, link, and unlink operations are direct MCP writes. The AI Agent must show the exact project, person, role, or link and stop for your approval before writing.

Before you start

You need:

• the correct environment and active workspace;
• an MCP connection with lab.analytics.write;
• the Workspace Owner role;
• the canonical Analytics Project identifier; and
• exact workspace-member or Lab Project identifiers.

Only existing members of the active workspace can receive Analytics Project roles.

Review current access

Begin with a read-only request:

Review active analytics access

In the active Culsma PAWS workspace, fetch Analytics Project [PROJECT NAME OR ID] and list all active Reader, Writer, and Publisher grants. Show each grantee's canonical user identifier, role, grant identifier, and any dataset scope. Do not change access.

Do not grant or revoke access from a name alone. Resolve the exact workspace member and active grant first.

Grant a role

Plan an analytics role grant

In Analytics Project [PROJECT ID], resolve workspace member [PERSON]. Propose the minimum role needed for [TASK]. Show the canonical user ID, exact project ID, role, and dataset scope if any. Do not grant access until I approve.

Choose roles according to the task:

• Reader: discover and query data.
• Writer: read, append, replace, or correct rows in existing tables.
• Publisher: create or change schemas, tables, columns, and views.

A Publisher does not automatically receive Reader or Writer behavior. Grant multiple roles only when the person’s work genuinely crosses those boundaries.

After approval, ask the AI Agent to list the project’s active grants again and show the new grant ID.

Revoke a role

1. list active grants for the exact Analytics Project;
2. identify the canonical grant ID to remove;
3. review the grantee, project, role, and dataset scope;
4. approve revocation of only that grant; and
5. list active grants again to verify the result.

Approve one role revocation

I approve revoking only grant [GRANT ID] from Analytics Project [PROJECT ID]. Revoke it, then list the remaining active grants and verify that no other role was changed.

Revoking a role does not delete the Analytics Project, schema, tables, data, or other grants.

Maintain Lab Project links

Lab Project links document relationship and provenance. They do not copy data or transfer permissions.

Before linking or unlinking:

• fetch the Analytics Project and its current links;
• resolve the exact Lab Project in the same workspace;
• explain whether the requested link already exists; and
• stop for approval before the direct write.

Unlinking removes only the metadata relationship. It does not delete analytics schemas or data already created from that source.

Review the evidence

For access changes, require:

• environment, workspace, and Analytics Project ID;
• canonical grantee user ID;
• Reader, Writer, or Publisher role;
• grant ID and dataset scope when present;
• revoked status for a removal; and
• a post-write list of active grants.

For source-link changes, require:

• Analytics Project ID;
• canonical Lab Project ID and name;
• link or unlink result; and
• a post-write list of current links.

Query, DDL, and CSV-load operations return their own audit identifiers. Preserve those identifiers with the analysis or maintenance result; the current pilot does not provide a Web/App audit-history screen.

More requests to try

Show the active roles for Analytics Project [PROJECT ID] and identify people who have Publisher access without Reader or Writer access. Do not change anything.

Prepare the minimum grants for Alex to create a table, load a CSV, and run verification queries. Show each required role separately and wait for approval.

List all Lab Projects linked to Analytics Project [PROJECT ID] and explain that links do not transfer access.

Resolve grant [GRANT ID] and show its current grantee, role, project, and status before asking to revoke it.

If governance cannot continue

What you see	What to do
The person is not a workspace member	Add or invite the person to the workspace before granting analytics access.
The Analytics Project is ambiguous	Resolve the canonical project ID before listing or changing grants.
You are not the Workspace Owner	Ask the owner to perform the governance operation.
The proposed role is broader than the task	Select the minimum role or smaller combination of roles.
A grant already exists	Reuse the active grant; do not create unnecessary duplicates.
The grant ID is missing during revocation	List active grants and resolve the exact grant before continuing.
A Lab Project belongs to another workspace	Stop; cross-workspace linking is not allowed.
An unlink is expected to delete data	Correct the expectation: unlinking removes metadata only.
Post-write grant or link lists do not match	Stop further governance changes and report the canonical IDs plus the mismatch.

You have completed governance when the active grants and Lab Project links match the approved plan and have been verified through MCP read-back.

Return to Analytics Projects Overview to choose the next task.