How do Cloud Pak for Data administrators obtain access to Match 360?

In IBM Cloud Pak for Data, platform-level administrative privileges do not automatically grant access to the functionalities within specific service instances like IBM Match 360. Access control for Match 360 is managed through service-specific user groups (Data Engineer, Data Steward, Publisher User, and Entity Viewer). To obtain access, a Cloud Pak for Data administrator, like any other user, must be explicitly added to one of these predefined user groups associated with the Match 360 service instance. This adheres to the principle of least privilege, ensuring that access to sensitive master data is strictly controlled and audited.

A. Each user who is assigned to a service group has access. This statement is generally true but is not the most precise answer to how an administrator obtains access. It describes the result of being in a group, not the requirement for the administrator.
B. Each user is automatically granted read access. This is incorrect. Access is not granted automatically to any user; it must be explicitly assigned to a specific role to prevent unauthorized access to potentially sensitive master data.
C. Administrative users automatically have access. This is incorrect. Cloud Pak for Data maintains a separation between platform administration and service-level access. An administrator role does not confer inherent permissions for all installed services.

1. IBM Cloud Pak for Data 4.8 Documentation

"Giving users access to IBM Match 360 with Watson": This official document outlines the procedure for granting access. It states

"To give users access to IBM Match 360

you must assign them the appropriate user role within the service." It then details the process of adding users to the service instance and assigning them to roles like Data Engineer or Data Steward

confirming that access is not automatic

even for administrators.

Reference Location: IBM Cloud Pak for Data 4.8 -> Services -> IBM Match 360 with Watson -> Administering -> Giving users access to IBM Match 360 with Watson.

2. IBM Cloud Pak for Data 4.8 Documentation

"Predefined roles and permissions": This section details the platform-level roles. The "Administrator" role is defined as having permissions to manage the platform

users

and service instances

but it does not grant automatic access into those services. This supports the concept that service-level access is managed separately.

Reference Location: IBM Cloud Pak for Data 4.8 -> Administering Cloud Pak for Data -> Managing users -> Predefined roles and permissions.

3. IBM Cloud Pak for Data 4.8 Documentation

"User roles and permissions for IBM Match 360": This page explicitly lists the four user groups (Data Engineer

Data Steward

Publisher User

Entity Viewer) and the permissions associated with each. It reinforces that access and capabilities within Match 360 are entirely dependent on membership in one of these groups.

Reference Location: IBM Cloud Pak for Data 4.8 -> Services -> IBM Match 360 with Watson -> Administering -> User roles and permissions.