How do authentication and data access work?

Python Library

Kumo Engine runs in your Python environment without a separate Kumo workspace login. Each connector uses credentials such as a cloud workload identity, notebook identity, or database account.

Restrict data access through that identity’s source-system permissions. A shared service identity uses its own grants; it does not automatically inherit the human user’s permissions. See Connect Your Data using Linux, Snowflake, or Databricks for authentication by source.

Helm Deployment

The prerelease Kumo Studio Helm deployment supports OIDC single sign-on or email and password authentication. Kumo group, project, and connector-identity permissions control access within the deployment.

Source-system access still depends on the connector’s credentials. Scope those credentials separately from Kumo sign-in permissions.

See Configure Single Sign-On for OIDC setup. The group claim identifies group membership; permission mapping is configured separately in the admin UI or API.