> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/data-governance.md).

# Data governance

How e6data governs access to data within a catalog - catalog-level access control, column masking, and row filtering, enforced deny-by-default.

Data governance controls **which data users can see** within a catalog, layered on top of the workspace roles that control *who can do what* (see [Identity and RBAC](/query-engine/guides/security/identity-and-rbac.md)). Governance is enforced per catalog and is **deny-by-default**: when a catalog is created, no one can query its data until a privilege grants access.

## What governance covers

e6data offers three privilege types, all created from a catalog's **Privilege** tab:

| Privilege                                                                                            | What it does                                                                                                                                          |
| ---------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Catalog-level access control](/query-engine/guides/data-governance/catalog-level-access-control.md) | Allow or deny query access at the catalog, database, table, and column level.                                                                         |
| Column masking                                                                                       | Obscure sensitive column values for users who lack access - see [Data access policies](/query-engine/guides/data-governance/data-access-policies.md). |
| Row filtering                                                                                        | Limit which rows a user can see based on a condition - see [Data access policies](/query-engine/guides/data-governance/data-access-policies.md).      |

You can also integrate an external policy engine - Apache Ranger, OPA, Unity, or Lake Formation - by enabling **Governance** when you register a catalog.

## How it relates to platform RBAC

Workspace roles (Admin, Manager, Viewer) govern platform actions - creating clusters, registering catalogs, managing users. **Data governance** governs which rows, columns, and tables a user can read once they can query a catalog. The two work together: a user needs both a role that lets them run queries *and* a catalog privilege that grants access to the data. See [Relationship to platform RBAC](/query-engine/guides/data-governance/relationship-to-platform-rbac.md).

## Key behaviors

* **Deny-by-default.** A catalog with no privileges denies all access; you grant access explicitly.
* **Deny precedence.** Where both allow and deny privileges could apply, deny always wins.
* **Propagation delay.** Allow up to 60 seconds for a new or changed privilege to take effect in the SQL engine.
* **Additive allows.** A user or group can belong to multiple privileges; if any allow grants access (and no deny applies), the query runs.

## In this section

* [Catalog-level access control](/query-engine/guides/data-governance/catalog-level-access-control.md) - allow/deny privileges across catalog, database, table, and column.
* [Data access policies](/query-engine/guides/data-governance/data-access-policies.md) - column masking and row filtering.
* [Relationship to platform RBAC](/query-engine/guides/data-governance/relationship-to-platform-rbac.md) - governance vs. workspace roles.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/data-governance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.