Unify and manage your data

Show Page Sections

Roles and Permissions for Match IQ Application

Learn more about assigning appropriate roles and permissions to different users of the Match IQ application.

System Roles

Note: Match IQ is not included in tenants created after the 2025.1 release. For more information, see topic Match IQ - Feb 2026​​.

The following system roles are available to run an external match, tenant match, and manage models:

  • ROLE_API, ROLE_USER - With these roles, a user can access the user interface of the Match IQ application.
  • ROLE_USER_MATCHIQ_EXTERNAL_MATCH - With this role, a user can run an external match job by using a ML model.
  • ROLE_USER_MATCHIQ_TRAIN_MODEL - With this role, a user can create and train the ML models but cannot delete a published model.
  • ROLE_USER_MATCHIQ_PUBLISH_MODEL - With this role, a user can publish the approved models. The user assigned to this role must also have a role (for example, ROLE_ADMIN_TENANT) assigned that allows the user to update the L3 configuration and run the rebuild match table task.
Note: Do not use the ROLE_USER_ML_MATCH role as it is being deprecated. Therefore, use the roles mentioned above and assign them as required.

For more granular control, you can create your own roles by assigning resources with the relevant privileges as explained in the table below.

Table 1. Match IQ Service - Permissions
Service IdResource IDSub-Resource IDLabelDescriptionPrivileges
riqThis permission is required to launch the jobs for data analysis and training.
actionsActions/Jobs
jobsJobsCREATE, READ, DELETE
configConfigREAD
mlMatchexternalMatchML Match Flow APIAPIs for external ML match CREATE, READ, UPDATE, DELETE
flow
mappingColumn MappingAPIs for column mappingCREATE, READ, UPDATE, DELETE
publishGet Published ModelsML Model Publish APIREAD
modelML Model Flow APIModel flowsCREATE, READ, UPDATE, DELETE, EXECUTE
flowModelsModel Flow Creation APIsCREATE, READ, UPDATE, DELETE
trainML Model TrainingAPIs for training the ML Model CREATE, READ, DELETE
approveML Model ApproveAPI to approve the ML model EXECUTE
publishML Model PublishAPI to publish the ML modelREAD, EXECUTE
unpublishML Model UnPublishAPI to unpublish the ML modelEXECUTE
configMatch IQ ConfigConfiguration of Match IQ READ
activeLearningActive Learning ServiceThis service is used to manage Active Learning sessions.
sessionAL Training ModelAPIs for training the ML ModelCREATE, READ, DELETE
modelCreating Final ModelAPI for the final modelCREATE, READ, DELETE
predictionPredictionAPIs for predictionCREATE, READ, DELETE
MDMFor Internal Publish of the Model
configbusinessModelFor updating L3READ, UPDATE
environmenttasks.matchFor triggering reindex jobsEXECUTE
tasks.reindexFor triggering reindex jobsEXECUTE