RBAC
How access control works in Galaxy
Galaxy governs who can see and do what with roles, permissions, and tags — so the right people reach the right data, and nothing else.
- 1.
Roles — grouped permissions.
A role is a named bundle of permissions — Admin, Analyst, Viewer, External. You assign people to roles instead of granting access one object at a time.
- 2.
Tags — policy that scales.
Tag objects and sources by sensitivity — pii, financial, confidential — then write rules against the tags. New data inherits the right policy automatically the moment it's tagged.
- 3.
The matrix — see access at a glance.
The permission matrix shows every role against every tag, so you can verify exactly who can read, mask, or manage each class of data in one view.
- 4.
Enforced everywhere.
The same rules apply in the app, the API, and over MCP — access is decided once and honored by every surface.