> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domino.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sharing and access

> Projects, Datasets, Data Sources, External Data Volumes, Apps, and Compute Environments are each permissioned separately, so working with data inside a Project takes access to the Project and to the data.

Access in Domino stacks. To use a Dataset, Data Source, or External Data Volume (EDV) inside a Project, you need access to the Project **and** to that entity. Neither substitutes for the other: a collaborator who was never granted the Dataset cannot read it, and holding the Dataset does not let you into the Projects that use it.

```mermaid placement="top-right" theme={null}
flowchart LR
    you["You"] --> proj["Access to<br/>the Project"]
    you --> data["Access to the Dataset,<br/>Data Source, or EDV"]
    proj --> use["You can use that data<br/>inside that Project"]
    data --> use
```

That is why an invitation is sometimes not enough. When a collaborator lacks permission on a Data Source the Project uses, Domino flags it on the Project's **Data** page and on the **Data** tab in a Workspace. The fix is for the entity's owner to grant access, not for you to invite the person to the Project again.

## Who grants access to each entity

Whoever owns an entity grants access to it, except where only an administrator can. An administrator alone grants an External Data Volume, shares a Data Source with everyone in the deployment, and makes a Compute Environment globally accessible.

| Entity               | Who grants access                                                                  | How access is granted                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| :------------------- | :--------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Project              | The owner sets visibility; the owner or any contributor invites collaborators      | A [visibility level](/6.3/platform-capabilities/core-concepts/projects/project-settings#set-project-visibility) of **Public**, where anyone with the URL can view the files and runs without a Domino account, **Searchable**, where the name and description appear in search but the contents stay hidden, or **Private**, where only collaborators can find it at all. On top of that, named collaborators and organizations, each holding a [collaborator role](/6.3/platform-capabilities/core-concepts/projects/collaborate-on-projects#collaborator-permissions) |
| Dataset              | The Dataset owner                                                                  | An [Owner, Editor, or Reader role](/6.3/platform-capabilities/core-concepts/data/sharing-and-security/share-datasets#dataset-roles) granted to users and organizations                                                                                                                                                                                                                                                                                                                                                                                                  |
| Data Source          | The Data Source owner, or an administrator                                         | [Specific users or organizations](/6.3/platform-capabilities/core-concepts/data/sharing-and-security/share-data-sources#share-a-data-source); an administrator can instead share it with everyone in the deployment                                                                                                                                                                                                                                                                                                                                                     |
| External Data Volume | An administrator only                                                              | The [Volume Access setting](/6.3/platform-capabilities/core-concepts/data/sharing-and-security/share-edv#edv-security-settings): everyone in the deployment, or specific users and organizations. A separate **Mount as read-only** setting decides whether you can write to it                                                                                                                                                                                                                                                                                         |
| App                  | A Project contributor or owner                                                     | Edit rights are inherited from the parent Project. [View rights](/6.3/platform-capabilities/features/apps/authentication-and-identity/app-security#access-controls-and-permissions) are set on the App itself: **Restricted** to named viewers and Project collaborators, optionally **Globally discoverable** so other users can request access, or **Anyone in Domino**                                                                                                                                                                                               |
| Compute Environment  | Whoever creates the environment; an administrator for **Globally Accessible** ones | A [visibility level](/6.3/platform-capabilities/core-concepts/compute-environments/manage-compute-environments/3-create-an-environment) of **Private**, **Available to an Organization**, or **Globally Accessible**                                                                                                                                                                                                                                                                                                                                                    |

Only the Project owner can change a Project's visibility. Some deployments also reserve collaborator management for Project owners alone, in which case contributors do not see the **Invite** button.

<Warning>
  Public visibility exposes a Project's files and runs to anyone with the URL, with no Domino account required, though only collaborators can start runs. Selecting **Allow runs by anonymous users** on top of it lets anyone run your code. Check what the Project reveals, including environment variables holding bearer tokens, API keys, and passwords, before you allow anonymous runs.
</Warning>

<Note>
  Domino does not control access to an external Git repository attached to a Project. Manage that in your Git host.
</Note>

All of this sits on top of the global role an administrator assigns you. **Practitioner**, the role every user starts with, is what lets you create Projects, run Jobs, start Workspaces, and publish Apps in the first place. See [Administer identity and access control](/6.3/admin/security-and-compliance/auth-identity-access-control) for the administrator's side: identity providers, role assignment, service accounts, and the deployment settings that change what any of this allows.

## Share with an organization

An organization is a named group of users that Domino permissions as a single unit. Grant access to an organization rather than to named individuals whenever a team, not a person, is what needs it. You grant it once, and membership does the rest.

* Add an organization as a Project collaborator and every member holds that collaborator role.
* Change the membership and Domino updates each member's Project access for you.
* Every member holds owner-level access to the Projects owned by the organization's own account, so a Project owned by an organization is open to all of its members.
* A Project owner who belongs to an organization can use that organization's Compute Environments. Losing membership resets the affected Projects to your default environment, and Domino notifies you.

An organization is owned by the user who created it. That owner adds and removes members and can make another user an owner; other members cannot change the membership, and platform administrators can change any organization's. In deployments that [synchronize Security Assertion Markup Language (SAML) groups to organizations](/6.3/admin/identity-and-access/authentication/sso/group-role-synchronization#saml-group-to-organization-synchronization), membership follows the directory instead. [Manage organizations](/6.3/platform-capabilities/features/collaboration/manage-organizations) covers creating one and the patterns it supports, including holding production-grade Projects under an organization rather than a person.

Your deployment can also narrow who you are allowed to invite to a Project to members of your own organizations. If a person you expect to find is not offered, that setting is the reason.

## Authenticate scripts and pipelines

A script, notebook, or pipeline authenticates with its own credential instead of a browser session, and it reaches exactly what that credential's identity already reaches. A credential never widens access.

|                        | Personal Access Token                                                            | Domino Service Account                                                                                                               |
| :--------------------- | :------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------- |
| Who creates it         | You, from your own account settings                                              | An administrator, through the Domino API                                                                                             |
| Whose identity it uses | Yours                                                                            | A technical user that cannot sign in to the web interface or the CLI                                                                 |
| Which roles it carries | The roles you hold. Changing your roles revokes the token instead of updating it | The roles the account held when the token was issued; later role changes do not reach tokens already issued                          |
| How long it lasts      | However long you choose when you create it                                       | Four months by default                                                                                                               |
| Use it for             | Your own scripts, notebooks, and Jobs                                            | Continuous integration and continuous delivery (CI/CD) pipelines, monitoring and automation tools, and system-to-system integrations |

Create a [Personal Access Token](/6.3/reference/api/domino-api-authentication#create-a-personal-access-token) under **Account**, then **Account settings**, then **Personal Access Token**. Pick an expiration and copy the value at that moment: Domino never shows it again, and no administrator can retrieve it for you.

<Warning>
  Changing your roles revokes every Personal Access Token you hold. If an administrator adjusts them, your scripts, notebooks, and scheduled Jobs stop authenticating until you create replacement tokens.
</Warning>

<Note>
  **Best practice:** keep Personal Access Tokens for your own work and ask an administrator for a Domino Service Account for anything shared. A service account's tokens belong to no individual, so deactivating a departing employee never breaks a pipeline.
</Note>

## Related

* [Manage organizations](/6.3/platform-capabilities/features/collaboration/manage-organizations): create an organization and use it to hold Projects, access, and Compute Environments.
* [Collaborate on Projects](/6.3/platform-capabilities/core-concepts/projects/collaborate-on-projects): invite collaborators and see what each Project role can do.
* [Share data securely](/6.3/platform-capabilities/core-concepts/data/sharing-and-security): the full permission model for Datasets, Data Sources, and External Data Volumes.
* [App security](/6.3/platform-capabilities/features/apps/authentication-and-identity/app-security): view and edit rights on a published App, and the identity headers it receives.
* [Domino Service Accounts](/6.3/admin/identity-and-access/manage-users/service-accounts): what a service account can do, and what to ask an administrator for.
* [Domino API authentication](/6.3/reference/api/domino-api-authentication): create, use, and revoke a Personal Access Token.
* [Protecting tokens and API keys](/6.3/admin/security-and-compliance/protecting-tokens-api-keys): store and rotate credentials without exposing them in code.


## Related topics

- [Publish and share an App](/6.3/platform-capabilities/features/apps/publish-an-app.md)
- [Develop collaboratively](/6.3/platform-capabilities/features/collaboration/collaborative-development.md)
- [Share Data Sources securely](/6.3/platform-capabilities/core-concepts/data/sharing-and-security/share-data-sources.md)
- [Data](/6.3/platform-capabilities/core-concepts/data/index.md)