Configuring Glossary Term Policies Correctly: Setting Scope to 'All' for Term Creation

Area: Product Issues

Sub-Area: Permissions & Policy Configuration

Issue

When creating a Metadata policy in DataHub to allow specific users to create and edit Glossary Terms and Term Groups — without granting broader data asset edit permissions — users may still find that the "Create Glossary Term" button is disabled or that term creation fails. This occurs even when the correct privileges (such as Create Entity, Manage Direct Glossary Children, and Manage All Glossary Children) appear to be selected in the policy. The root cause is typically that the Glossary Terms & Term Groups scope filter within the policy is set to None instead of All, which means the policy has no target hierarchy to apply against and is effectively inactive.

You Might Be Asking

• Why can't my users create glossary terms even though I gave them the right privileges in a Metadata policy?
• What does the "Glossary Terms & Term Groups" scope field in a policy do, and why does setting it to "None" matter?
• Is a Metadata policy alone enough to allow users to create root-level glossary terms?
• How do I grant glossary creation access without giving users the full Editor role?

Solution

1. Navigate to Settings > Permissions > Policies in your DataHub instance.

2. Locate and open the Metadata policy you created for Glossary Terms access.

3. Find the Glossary Terms & Term Groups scope filter. If it is currently set to None, change it to All.

   Glossary Terms & Term Groups: None  ❌  (policy has no target — privileges cannot apply)
   Glossary Terms & Term Groups: All   ✅  (policy applies across the full glossary hierarchy)

4. Confirm that the following privileges are selected within the same policy:

   • Create Entity — allows creation of new glossary terms or term groups
   • Manage Direct Glossary Children — allows editing terms directly under a specific Term Group
   • Manage All Glossary Children — allows editing terms anywhere in the glossary hierarchy

5. Save the policy and ask the affected users to log out and back in (or wait for the policy cache to refresh) before testing again.

6. If users also need to create root-level glossary terms (terms not nested under any Term Group), an additional Platform policy is required. Create a separate Platform policy that grants the Manage Glossaries privilege to those users:

   Policy Type:  Platform
   Privilege:    Manage Glossaries
   Actors:       <your-target-users-or-group>

   This is necessary because root-level glossary entity creation requires platform-level authorization, which Metadata policies alone cannot provide.

Additional Notes

The Glossary Terms & Term Groups scope field in a Metadata policy acts as a filter that determines which part of the glossary hierarchy the policy applies to. When set to None, no parent glossary node is selected, so even correctly specified privileges have no target and are never enforced. This is a common misconfiguration that is easy to overlook because the rest of the policy — Asset Type, Actors, and Privileges — may appear correctly configured. Always verify that this scope field is set to All (or scoped to specific Term Groups as needed) when creating glossary management policies. Note that Metadata policies and Platform policies serve distinct authorization purposes: Metadata policies govern operations on existing entities within a hierarchy, while Platform policies govern instance-wide capabilities such as creating top-level entities.

Related Documentation

• DataHub Authorization Policies
• Glossary Term Entity Reference
• Glossary Node Entity Reference
• DataHub Roles & Privileges Overview

Tags: glossary-terms, policy-configuration, permissions, metadata-policy, platform-policy, manage-glossaries, create-entity, access-control, term-groups, authorization