> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/data-governance/catalog-level-access-control.md).

# Catalog-level access control

Grant or deny query access at the catalog, database, table, and column level with allow and deny privileges.

Catalog privileges manage access at the catalog, database, table, and column level. They ensure only intended users can query data, and they are **deny-by-default** - when a catalog is created, all access is denied until you create a privilege that grants it.

{% hint style="info" %}
Managing catalog privileges requires an administrative role; querying data requires a role with query access. See [Roles and permissions](/query-engine/guides/security/identity-and-rbac/roles-and-permissions.md). Use access control carefully, as it governs who can read potentially sensitive data.
{% endhint %}

## How privileges resolve

* The permission hierarchy is **Catalog → Database → Table → Column**. Selecting a database includes all its tables unless you select specific tables; selecting a table includes all its columns unless you select specific columns.
* Selecting **all (`*`)**, or leaving the table/column fields empty, grants access to everything below the selected level.
* With no privilege defined for a catalog, access is **denied** by default.
* A user or group can belong to multiple privileges at once. **Allow** grants query access; **Deny** always takes precedence over Allow.
* Allow up to **60 seconds** for a new or changed privilege to be applied by the SQL engine.
* A newly added user has no query access until they're assigned to a catalog privilege.

## Create a privilege

1. Navigate to **Catalogs** and click the desired catalog.
2. Select the **Privilege** tab.
3. Click **Create Privileges** and give the privilege a name (and optional description).
4. Select the **Access Control** privilege type.
5. Select the databases, tables, and columns.
6. Choose the access type - **Allow** or **Deny**.
7. Select the user(s) and group(s) the privilege applies to.
8. Click **Create**. The privilege appears in the Privileges list.

To edit, click the three dots next to a privilege, select **Edit**, adjust the resources, access type, or assigned users/groups, and click **Update**.

## Allow privileges

An Allow privilege grants access to the selected resources. Multiple Allow privileges are additive - if any grants access (and no Deny applies), the query runs. Common patterns:

* **All databases:** select all databases; leave table/column fields empty to grant access to the entire catalog.
* **Selected databases:** select specific databases (and optionally tables/columns) - access to unselected databases is denied.
* **Selected tables and columns:** select a schema and table, then specific columns - querying unselected columns fails, while querying the permitted columns succeeds.

Verify a privilege from the **Query Editor**: select the catalog, database, and cluster, and run queries to confirm only authorized data returns.

## Deny privileges

A Deny privilege restricts access to the selected resources and **takes precedence** over any Allow. A Deny only denies - it does not grant access to anything else.

{% hint style="info" %}
A Deny privilege results solely in access denial; it does not imply permission for other resources. To grant access, create a separate Allow privilege.
{% endhint %}

Deny works at the same granularity as Allow - all databases, selected databases, or selected tables and columns. For example, a Deny on all databases blocks query execution across the catalog regardless of Allow privileges.

## See also

* [Data governance overview](/query-engine/guides/data-governance.md)
* [Data access policies](/query-engine/guides/data-governance/data-access-policies.md) - column masking and row filtering.
* [Roles and permissions](/query-engine/guides/security/identity-and-rbac/roles-and-permissions.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/data-governance/catalog-level-access-control.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.