Data governance
How e6data governs access to data within a catalog - catalog-level access control, column masking, and row filtering, enforced deny-by-default.
Data governance controls which data users can see within a catalog, layered on top of the workspace roles that control who can do what (see Identity and RBAC). Governance is enforced per catalog and is deny-by-default: when a catalog is created, no one can query its data until a privilege grants access.
What governance covers
e6data offers three privilege types, all created from a catalog's Privilege tab:
Allow or deny query access at the catalog, database, table, and column level.
Column masking
Obscure sensitive column values for users who lack access - see Data access policies.
Row filtering
Limit which rows a user can see based on a condition - see Data access policies.
You can also integrate an external policy engine - Apache Ranger, OPA, Unity, or Lake Formation - by enabling Governance when you register a catalog.
How it relates to platform RBAC
Workspace roles (Admin, Manager, Viewer) govern platform actions - creating clusters, registering catalogs, managing users. Data governance governs which rows, columns, and tables a user can read once they can query a catalog. The two work together: a user needs both a role that lets them run queries and a catalog privilege that grants access to the data. See Relationship to platform RBAC.
Key behaviors
Deny-by-default. A catalog with no privileges denies all access; you grant access explicitly.
Deny precedence. Where both allow and deny privileges could apply, deny always wins.
Propagation delay. Allow up to 60 seconds for a new or changed privilege to take effect in the SQL engine.
Additive allows. A user or group can belong to multiple privileges; if any allow grants access (and no deny applies), the query runs.
In this section
Catalog-level access control - allow/deny privileges across catalog, database, table, and column.
Data access policies - column masking and row filtering.
Relationship to platform RBAC - governance vs. workspace roles.
Last updated
Was this helpful?