DOC-442 | Authentication of notebooks

arangograph/access-control.md

@@ -342,6 +342,9 @@ The roles below are described following this pattern:
 - `notebook.notebook.resume`
 - `notebook.notebook.update`
 
+**Notebook Executor** (`notebook-executor`):
+- `notebook.notebook.execute`
+
 **Notebook Viewer** (`notebook-viewer`):
 - `notebook.model.list`
 - `notebook.notebook.get`
@@ -458,6 +461,8 @@ Permissions are solely defined by the ArangoGraph API.
 {% comment %}
 Retrieved with the below command, with manual adjustments:
 oasisctl list permissions
+
+Note that if the tier is "internal", there is an `internal-dashboard` API that should be excluded in below list!
 {% endcomment %}
 
 | API                 | Kind                         | Verbs
@@ -497,7 +502,7 @@ oasisctl list permissions
 | `monitoring`        | `logs`                       | `get`
 | `network`           | `privateendpointservice`     | `create`, `get`, `get-by-deployment-id`, `get-feature`, `update`
 | `notebook`          | `model`                      | `list`
-| `notebook`          | `notebook`                   | `create`, `delete`, `get`, `list`, `pause`, `resume`, `update`
+| `notebook`          | `notebook`                   | `create`, `delete`, `execute`, `get`, `list`, `pause`, `resume`, `update`
 | `notification`      | `deployment-notification`    | `list`, `mark-as-read`, `mark-as-unread`
 | `prepaid`           | `prepaiddeployment`          | `get`, `list`
 | `replication`       | `deploymentreplication`      | `get`, `update`

arangograph/notebooks.md

@@ -44,11 +44,17 @@ favorite GraphML libraries with GPUs.
 1. Navigate to the **Deployments** tab.
 2. Open the deployment in which you want to create the notebook.
 3. Go to the **Notebooks** tab and click the **Create Notebook** button.
-4. Enter a name and optionally a description for your new notebook. Click **Save**.
-5. The notebook's phase is set to **Initializing**. Once the phase changes to
-**Running**, the notebook's endpoint will be accessible.
-6. Click the **Open notebook** button to access your notebook. 
-7. To log in into your notebook, use the `root` password from your deployment.
+4. Enter a name and optionally a description for your new notebook. 
+5. Select a configuration model from the dropdown menu. Click **Save**.
+6. The notebook's phase is set to **Initializing**. Once the phase changes to
+   **Running**, the notebook's endpoint is accessible.
+7. Click the **Open notebook** button to access your notebook. 
+8. To access your notebook, you need to be signed into ArangoGraph as a user with
+   the `notebook.notebook.execute` permission in your project. Organization
+   owners have this permission enabled by default. The `notebook-executor` role
+   which contains the permission can also be granted to other members of the
+   organization via roles. See how to create a
+   [role binding](access-control.html#how-to-view-edit-or-remove-role-bindings-of-a-policy).
 
 {% hint 'info' %}
 Depending on the tier your organization belongs to, different limitations apply: