The two-plane model
The Control Plane decides whether a person or service belongs to your organization at all. The Compute Plane decides what they can do inside a specific workspace. Each plane has its own permission vocabulary because each protects a different surface, and the two are linked by an automatic sync that propagates identities, group memberships, and role assignments from the Control Plane to each workspace.
Identities and group memberships created on the Control Plane are synced to each workspace automatically, typically within about 30 seconds.
Identity types
For how these credentials are created, used, and rotated, see Access tokens. For e6data engineer access, see Support access.
Where to go next
See also
- Access tokens - personal access tokens and service account keys.
- Support access - e6data engineer access with per-tenant alias privacy.