> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and RBAC overview

> How e6data controls who can access your platform and what they can do, across the Control Plane and the Compute Plane.

e6data controls **who** can access your data platform and **what** they are allowed to do across two planes: the **Control Plane** (organization-wide management) and the **Compute Plane** (per-workspace data and query operations).

This section is for organization admins, security and compliance teams, and developers integrating with the e6data APIs.

## The two-plane model

The Control Plane decides whether a person or service belongs to your organization at all. The Compute Plane decides what they can do inside a specific workspace. Each plane has its own permission vocabulary because each protects a different surface, and the two are linked by an automatic sync that propagates identities, group memberships, and role assignments from the Control Plane to each workspace.

| | Control Plane | Compute Plane |
| - | - | - |
| Scope | Your whole organization | A single workspace |
| Protects | Org management: users, groups, workspaces, billing, SSO, invitations | Data operations: queries, catalogs, schedules, governance |
| Identities | Users, groups, service accounts | Users, groups, service accounts, access tokens |
| Authorization | A fixed set of named permissions and built-in roles (Admin, Manager, Viewer) | Roles built from resource + action rules, attached by role bindings |

Identities and group memberships created on the Control Plane are synced to each workspace automatically, typically within about 30 seconds.

## Identity types

| Identity | Where it lives | Credential | Best for |
| - | - | - | - |
| User | Control Plane + workspace | SSO / OIDC session, OTP login | Humans - engineers, analysts, admins |
| Group | Control Plane + workspace | Membership only | Assigning roles to a whole team at once |
| Service Account | A single workspace | `e6sa_…` API key | Workspace automation: CI/CD, scheduled jobs |
| Personal Access Token | Workspace | `e6pat_…` API key | Ad-hoc developer scripts tied to a user identity |
| Support User | Control Plane + workspace | e6data SSO | e6data engineer assistance, with alias-based privacy |

For how these credentials are created, used, and rotated, see [Access tokens](/platform/tokens/pat-and-service-account-keys). For e6data engineer access, see [Support access](/platform/support-access/enable-audit-block).

## Where to go next

| If you want to… | Go to |
| - | - |
| Understand the permission grammar before designing roles | [Control Plane vs Compute Plane permissions](/platform/identity/control-plane-vs-compute-plane) |
| Manage human and machine identities | [Users, groups, and service accounts](/platform/identity/users-groups-service-accounts) |
| Assign roles and permissions | [Roles and permissions](/platform/identity/roles-and-permissions) |
| Generate an API key or token | [Access tokens](/platform/tokens/pat-and-service-account-keys) |

## See also

* [Access tokens](/platform/tokens/pat-and-service-account-keys) - personal access tokens and service account keys.
* [Support access](/platform/support-access/enable-audit-block) - e6data engineer access with per-tenant alias privacy.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.