Relationship to platform RBAC
How data governance and platform RBAC differ and work together - who can do what vs. which data they can see.
e6data has two distinct access-control systems. They're easy to confuse because both restrict access, but they protect different things and are configured in different places.
Two systems, two questions
Answers
Who can do what
Which data can they see
Examples
Create a cluster, register a catalog, manage users, run queries
Read a specific table, see a masked column, see filtered rows
Built from
Roles (Admin, Manager, Viewer) and role bindings
Catalog privileges: access control, column masking, row filtering
Configured in
Access Control (Console)
A catalog's Privilege tab
Scope
Workspace and platform operations
Within a catalog (catalog → database → table → column)
Default
A new user has no roles until assigned
A new catalog denies all data access until a privilege grants it
Platform RBAC is described in Identity and RBAC; data governance in Data governance.
How they combine
To query data, a user needs both:
A role that allows running queries on the relevant clusters and catalogs (platform RBAC).
A catalog privilege that grants access to the specific data (data governance).
Having one without the other isn't enough. A user with a query-running role but no catalog privilege can connect and submit queries, but reads are denied by the catalog's deny-by-default policy. Conversely, a catalog privilege grants nothing if the user has no role that lets them query at all.
Worked example
A BI analyst should run dashboards over the sales catalog but never see the salary column:
Platform RBAC - assign a role that allows running queries (for example, Viewer), scoped to the BI cluster.
Data governance - create an Allow privilege on
salesfor the analyst's group, and a column-masking privilege onsalary.
The analyst can now query sales (RBAC permits it) and sees every column except salary, which is masked (governance enforces it).
See also
Last updated
Was this helpful?