> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/security.md).

# Security

- [Identity and RBAC](https://docs.e6data.com/query-engine/guides/security/identity-and-rbac.md): How e6data controls who can access your platform and what they can do, across the Control Plane and the Compute Plane.
- [Control Plane vs Compute Plane permissions](https://docs.e6data.com/query-engine/guides/security/identity-and-rbac/control-plane-vs-compute-plane-permissions.md): The two permission grammars in e6data - Control Plane named permissions and Compute Plane resource-and-action rules - and how roles and bindings compose them.
- [Users, groups, and service accounts](https://docs.e6data.com/query-engine/guides/security/identity-and-rbac/users-groups-service-accounts.md): How human users, groups, and service accounts are created, synced to workspaces, and managed in e6data.
- [Roles and permissions](https://docs.e6data.com/query-engine/guides/security/identity-and-rbac/roles-and-permissions.md): The built-in Admin, Manager, and Viewer roles, what each can do, and how to design custom roles in e6data.
- [Access tokens](https://docs.e6data.com/query-engine/guides/security/access-tokens.md): How people and applications authenticate to an e6data workspace with access tokens - the credential types, what they carry, and how token auth relates to RBAC.
- [Personal access tokens and service account keys](https://docs.e6data.com/query-engine/guides/security/access-tokens/pat-and-service-account-keys.md): The two e6data credential types in detail - personal access tokens and service account keys - their formats and when to use each.
- [Create, use, rotate, and revoke tokens](https://docs.e6data.com/query-engine/guides/security/access-tokens/create-use-rotate-revoke.md): Create personal access tokens and service account API keys, use them over REST and JDBC/ODBC, set an expiry, rotate, and revoke them.
- [Token security best practices](https://docs.e6data.com/query-engine/guides/security/access-tokens/token-security-best-practices.md): How to store e6data tokens safely, scope them with least privilege, revoke them, manage them as an admin, and understand what the audit trail records.
- [Authentication](https://docs.e6data.com/query-engine/guides/security/authentication.md): How users sign in to e6data - local accounts, single sign-on, and TLS.
- [SSO setup](https://docs.e6data.com/query-engine/guides/security/authentication/sso-setup.md): Connect your identity provider to e6data via SAML 2.0 or OIDC so members sign in with corporate credentials, with just-in-time provisioning.
- [Domain auto-join and JIT provisioning](https://docs.e6data.com/query-engine/guides/security/authentication/domain-auto-join-and-jit.md): Let users join your organization automatically by email domain, and provision SSO users just-in-time on first sign-in.
- [TLS certificates](https://docs.e6data.com/query-engine/guides/security/authentication/tls-certificates.md): How TLS certificates work for e6data endpoints - Serverless (managed by e6data) vs In-VPC (managed by you).
- [Support access](https://docs.e6data.com/query-engine/guides/security/support-access.md): How e6data Support Users work - scoped, aliased, fully audited e6data engineer access that you can revoke at any time.
- [Enable, audit, and block support access](https://docs.e6data.com/query-engine/guides/security/support-access/enable-audit-block.md): Add, block, unblock, and list e6data Support Users over the API, the permissions required, and how their actions appear in your audit log.
- [Privacy controls](https://docs.e6data.com/query-engine/guides/security/support-access/privacy-controls.md): The per-tenant alias model behind e6data Support Users - how identities stay private, how audit history stays correct, and the security guarantees.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.