Permission Denied
An action is blocked, a field is locked, or you see fewer rows than expected — role gates, Data Keys, Data Gates, and warehouse access explained
In this section
Part of Celiq's semantic layer platform. Connect your warehouse, model your data once, query it everywhere.
Note
Celiq blocked an action, hid a field, or returned fewer rows than you expected. This is almost always your role, a Data Key, or a Data Gate — not a bug.
Symptoms
- A 403 message such as
Requires role: luminaryor "This action requires weaver role or higher". - The Import or Forge page redirects you home.
- A field shows a 🔒 icon, or columns you expect are missing entirely.
- A node returns zero rows for you but works for an admin.
- A tile shows a permission error; a Prism mentions ad-hoc SQL being restricted to admins.
Causes & fixes
| Symptom | Cause | Fix |
|---|---|---|
Requires role: luminary (403) | The action is luminaryOnly (e.g. minting/revoking an API key) | Have a Luminary perform it, or have your role raised in Lumen → Users. |
This action requires weaver role or higher (403) | A weaverAndAbove guard (e.g. creating a team) and your role is Tracer or Lens | Raise the role to Weaver or above. |
| Import / Forge page redirects you home | The page requires the create_nodes permission, carried only by Weaver and Luminary | Use a Weaver or Luminary account to build the model. |
| A non-Luminary sees zero rows on one node | A Data Key exists on that node but you have no assignment — Celiq is fail-closed (deny by default) | Assign the Data Key (or * for all rows) in Lumen → Security. |
| A 🔒 field, or columns missing for users below Weaver | A Data Gate hides those columns at query time; Data Gates only hide from users below Weaver | Confirm it's intended; if they should see it, adjust the gate. Weaver and Luminary always see gated columns. |
| "Access denied — the warehouse service account lacks permission…" | The connection's credentials can't query that table/dataset | Grant the warehouse service account access to the table/dataset. |
| Prism error mentioning ad-hoc SQL restricted to admins | The Prism stores raw SQL, so row/field policies can't be enforced for non-admins | Rebuild the Prism from a Reveal so Data Keys and Gates apply, or have a Luminary run it. |
Account disabled (401) | The account was disabled; the role check re-verifies active status each request | Re-enable the user in Lumen → Users. |
Still stuck?
There is no per-permission editor in Celiq — access is your role plus Data Keys (rows) and Data Gates (columns), nothing more. A Luminary can confirm your effective access with View as in Sudo. If you simply see fewer rows than a colleague, that is by design: Data Keys scope each person to their assigned values.