> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/data-governance/relationship-to-platform-rbac.md).

# Relationship to platform RBAC

How data governance and platform RBAC differ and work together - who can do what vs. which data they can see.

e6data has two distinct access-control systems. They're easy to confuse because both restrict access, but they protect different things and are configured in different places.

## Two systems, two questions

|               | Platform RBAC                                                   | Data governance                                                   |
| ------------- | --------------------------------------------------------------- | ----------------------------------------------------------------- |
| Answers       | *Who can do what*                                               | *Which data can they see*                                         |
| Examples      | Create a cluster, register a catalog, manage users, run queries | Read a specific table, see a masked column, see filtered rows     |
| Built from    | Roles (Admin, Manager, Viewer) and role bindings                | Catalog privileges: access control, column masking, row filtering |
| Configured in | Access Control (Console)                                        | A catalog's **Privilege** tab                                     |
| Scope         | Workspace and platform operations                               | Within a catalog (catalog → database → table → column)            |
| Default       | A new user has no roles until assigned                          | A new catalog denies all data access until a privilege grants it  |

Platform RBAC is described in [Identity and RBAC](/query-engine/guides/security/identity-and-rbac.md); data governance in [Data governance](/query-engine/guides/data-governance.md).

## How they combine

To query data, a user needs **both**:

1. A **role** that allows running queries on the relevant clusters and catalogs (platform RBAC).
2. A **catalog privilege** that grants access to the specific data (data governance).

Having one without the other isn't enough. A user with a query-running role but no catalog privilege can connect and submit queries, but reads are denied by the catalog's deny-by-default policy. Conversely, a catalog privilege grants nothing if the user has no role that lets them query at all.

## Worked example

A BI analyst should run dashboards over the `sales` catalog but never see the `salary` column:

1. **Platform RBAC** - assign a role that allows running queries (for example, Viewer), scoped to the BI cluster.
2. **Data governance** - create an Allow privilege on `sales` for the analyst's group, and a column-masking privilege on `salary`.

The analyst can now query `sales` (RBAC permits it) and sees every column except `salary`, which is masked (governance enforces it).

## See also

* [Data governance overview](/query-engine/guides/data-governance.md)
* [Catalog-level access control](/query-engine/guides/data-governance/catalog-level-access-control.md)
* [Roles and permissions](/query-engine/guides/security/identity-and-rbac/roles-and-permissions.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/data-governance/relationship-to-platform-rbac.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.