<!-- # hard line break macro for HTML -->

# plugins.label_schemas.permissions

Authorization for the label-schema operators.

Built on `ctx.user` (an
`fiftyone.operators.executor.ExecutionContextUser`). FiftyOne
has no users: `ctx.user` is `None` and every check passes, so the
schema lens is a visibility preference any App user may edit. FiftyOne
Enterprise populates `ctx.user` with the viewer’s `role` and
`dataset_permission` on every operator execution, and these checks
gate the operators there; an ADMIN bypasses dataset-permission
thresholds.

Reads are VIEW-gated: listing/getting docs feeds the Explore schema
lens and the dataset’s default-schema visibility, which must work for
every viewer of the dataset. Mutations are MANAGE-gated.

Copyright 2017-2026, Voxel51, Inc.
<br/>
[voxel51.com](https://voxel51.com/)
<br/>
<br/>

**Data:**

| [`PERMISSION_RANK`](#plugins.label_schemas.permissions.PERMISSION_RANK)   | Dataset permission levels, ordered.   |
|---------------------------------------------------------------------------|---------------------------------------|

**Functions:**

| [`permission_rank`](#plugins.label_schemas.permissions.permission_rank)(permission)                         | Rank for a dataset permission (string or enum), 0 when unknown.                                                              |
|-------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
| [`is_admin`](#plugins.label_schemas.permissions.is_admin)(ctx)                                              |                                                                                                                              |
| [`has_min_dataset_permission`](#plugins.label_schemas.permissions.has_min_dataset_permission)(ctx, minimum) | True when the viewer's dataset permission is at least `minimum` (no `ctx.user` → no permission system → True; ADMIN → True). |
| [`can_read`](#plugins.label_schemas.permissions.can_read)(ctx)                                              |                                                                                                                              |
| [`can_manage`](#plugins.label_schemas.permissions.can_manage)(ctx)                                          |                                                                                                                              |

### plugins.label_schemas.permissions.PERMISSION_RANK *= {'EDIT': 3, 'MANAGE': 4, 'NO_ACCESS': 0, 'TAG': 2, 'VIEW': 1}*

Dataset permission levels, ordered. Mirrors
`fiftyone.internal.dataset_permissions.DatasetPermission`.

### plugins.label_schemas.permissions.permission_rank(permission) → int

Rank for a dataset permission (string or enum), 0 when unknown.

### plugins.label_schemas.permissions.is_admin(ctx) → [bool](../../api/fiftyone.core.stages.md#fiftyone.core.stages.Exists.bool)

### plugins.label_schemas.permissions.has_min_dataset_permission(ctx, minimum: str) → [bool](../../api/fiftyone.core.stages.md#fiftyone.core.stages.Exists.bool)

True when the viewer’s dataset permission is at least `minimum`
(no `ctx.user` → no permission system → True; ADMIN → True).

### plugins.label_schemas.permissions.can_read(ctx) → [bool](../../api/fiftyone.core.stages.md#fiftyone.core.stages.Exists.bool)

### plugins.label_schemas.permissions.can_manage(ctx) → [bool](../../api/fiftyone.core.stages.md#fiftyone.core.stages.Exists.bool)