> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/data-governance/data-access-policies.md).

# Data access policies

Apply column masking and row filtering to control which data users can see within a catalog.

Data access policies control which data users can see within a catalog, beyond catalog-level access. e6data supports two policy types: **column masking** (obscure sensitive column values) and **row filtering** (limit which rows a user can see). Both are created from a catalog's **Privilege** tab.

## Column masking

Column masking obscures sensitive data in specific columns from users who lack the appropriate privileges. Authorized users see the full data; others see a masked version. Supported masking types:

* **Mask** - replace the entire value with placeholder characters (regex replacement).
* **Mask first 4 characters** - keep the first four characters, mask the rest.
* **Mask last 4 characters** - keep all but the last four characters.
* **Hash (SHA-256)** - replace the value with an irreversible SHA-256 hash.

### Create a column-masking privilege

1. Navigate to **Catalogs** and click the desired catalog.
2. Select the **Privilege** tab.
3. Click **Create Privileges** and give the privilege a name (and optional description).
4. Select **Column masking** as the privilege type.
5. Select the databases and tables.
6. Select the columns and the masking type for each.
7. Select the user(s) and group(s) the privilege applies to.
8. Click **Create**. The privilege appears in the Privileges list.

### Limitations

* Column masking applies only to string data types.
* For string fields with 4 characters, `show_first_4` and `show_last_4` display the field unmasked.
* When masked columns are used in string functions, governance applies the string function first, then masks the result.
* Masking is not supported for values with special characters.
* Masking of values in `json_value` functions is not supported. If a masked column is aggregated, the final output is not masked.

## Row filtering

Row filtering limits which rows a user can see based on a condition - useful when different users need access to the same dataset at different scopes (for example, sales reps seeing only their assigned customers).

### Create a row-filter privilege

1. Navigate to **Catalogs** and click the desired catalog.
2. Select the **Privilege** tab.
3. Click **Create Privileges** and give the privilege a name (and optional description).
4. Select **Row filter** as the privilege type.
5. Select the databases.
6. Select the table and enter the filter expression (for example, `cc_employees=6879074`).
7. Select the user(s) and group(s) the privilege applies to.
8. Click **Create**.

The filter applies only to the selected table(s) and user(s) - other tables and users are unaffected.

### Limitations

* Subqueries in row-filter conditions are not yet supported.
* Row-filter conditions with aggregate functions are not yet supported (aggregations belong in the `HAVING` clause).
* For multiple row filters on the same table, only the first filter applies in a query that combines them.

## Edit or delete a policy

To edit, click the three dots next to the privilege, select **Edit**, change the databases, tables, columns/expression, or assigned users and groups, and click **Update**. To delete, select **Delete** from the same menu and confirm by typing `Delete`.

## See also

* [Governance overview](/query-engine/guides/data-governance.md)
* [Catalog-level access control](/query-engine/guides/data-governance/catalog-level-access-control.md)
* [Identity and RBAC](/query-engine/guides/security/identity-and-rbac.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/data-governance/data-access-policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.