Default posture
Nothing is enabled by default. When a workspace admin connects a data warehouse integration, Coalesce Quality stores the workspace credentials encrypted. These credentials do not back any user-facing feature automatically. Each capability has its own toggle, and the admin must turn it on. Workspace credentials usually have broader grants than the warehouse account of a single member. If they backed member queries by default, those queries would skip the member’s own grants, masking policies and row-level security.The two authentication paths
Personal credentials (recommended)
Each member authenticates as themselves. Queries run under the member’s own warehouse account, so your warehouse-side controls apply to them: grants, masking policies, row-level security and audit logs. The workspace admin enables personal credentials on the integration. Each member then connects from Settings → Warehouse access → My credentials. Depending on the warehouse, a member saves a username and password or an access key, or completes an OAuth consent flow. Credentials are stored encrypted. Only the member who saved them can use them, and the admin never sees them. For Snowflake, BigQuery, Databricks and Microsoft Fabric, Coalesce Quality uses the warehouse’s user-level OAuth flow instead of a password. The admin configures an OAuth app on the integration once. Each member then completes a short consent in the browser, and Coalesce Quality stores that member’s access and refresh tokens. To revoke access, revoke the OAuth app in the warehouse. When you pick Personal for a query, it runs as you or it fails. Coalesce Quality does not fall back to the workspace credentials, as that would change which warehouse-side controls apply. If your personal credentials are not configured, or the admin has not enabled personal access for the integration, you get a permission-denied error. You can then retry with workspace credentials yourself.Workspace credentials (requires opt-in)
Data preview, reconciliation (ad-hoc and scheduled) and column and table
profiling are in early access. The capability toggles below show only in
workspaces that have early access. If a toggle is not on your integration,
the feature is not available in your workspace.
- A member can preview data without connecting personal credentials first.
- Ad-hoc reconciliation can run for members who do not have personal access.
- Scheduled jobs and managed agents run with no member present, so they always use workspace credentials.
When a toggle is on, every workspace member can use that feature with the
warehouse access of the shared workspace account. Per-member warehouse
controls (grants, masking policies, row-level security) do not apply to these
queries, as they run as the workspace account. Keep the toggles off unless you
have narrowed the warehouse access of the workspace credentials to a level you
are comfortable sharing with the whole workspace.
The toggles apply to everyone who uses the integration, including workspace
admins. Editing an integration and using it are separate permissions. An
admin without personal credentials has the same limits as any other member.
Where these are configured
Both pages are under Settings → Warehouse access:- Overview (admins only) lists every data warehouse integration with its personal access setting and its five capability toggles.
- My credentials is available to every member. It lists the warehouses where the admin enabled personal credentials. Members connect (with OAuth or a username and password) or disconnect their own credentials there. Members without personal credentials can use the workspace credentials only for the capabilities the admin turned on.
Support access to your data
When a Coalesce Quality support engineer joins your workspace to investigate a case, the session has stricter rules than a normal member session. A support session cannot use the workspace credentials of your data warehouse integrations, whatever the capability toggles are. This applies in every workspace, region and integration type. The app blocks this, and the platform checks it again each time it loads the credentials. If a support engineer needs to run queries, they use their own personal credentials, for their own warehouse account. Your warehouse-side controls apply to them like to any other user, and your warehouse audit logs show the engineer’s account, not a shared service account. Query results are in transit only. Result rows go straight to the feature that asked for them (a preview pane, a reconciliation run, a Scout investigation). They are not written to Coalesce Quality storage or logs. Each use of workspace credentials is recorded by the platform, with the user, the integration and the workspace. Blocked attempts are recorded too. If you need to investigate an access, support can help. Automated system jobs (data ingestion, scheduled reconciliation, managed Scout) have no user session. Only the capability toggles control them.Recommended setup
- Connect your data warehouse integration with workspace credentials that have only the grants that ingestion needs (metadata, query logs). See the security policy for the access model.
- If your warehouse supports it, configure an OAuth app on the integration so members can authenticate as themselves.
- If not, turn on Let members sign in with personal credentials, so members can save their own username and password.
- Keep the five capability toggles off.
- Ask members to connect from My credentials.
- Turn on a capability only for a feature that needs it (scheduled reconciliation, Scout AI), or when per-member grants are not practical and you have narrowed the grants of the workspace credentials to a level you are comfortable sharing.