> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/guides/security/identity-and-rbac.md).

# Identity and RBAC

How e6data controls who can access your platform and what they can do, across the Control Plane and the Compute Plane.

e6data controls **who** can access your data platform and **what** they are allowed to do across two planes: the **Control Plane** (organization-wide management) and the **Compute Plane** (per-workspace data and query operations).

This section is for organization admins, security and compliance teams, and developers integrating with the e6data APIs.

## The two-plane model

The Control Plane decides whether a person or service belongs to your organization at all. The Compute Plane decides what they can do inside a specific workspace. Each plane has its own permission vocabulary because each protects a different surface, and the two are linked by an automatic sync that propagates identities, group memberships, and role assignments from the Control Plane to each workspace.

|               | Control Plane                                                                | Compute Plane                                                       |
| ------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| Scope         | Your whole organization                                                      | A single workspace                                                  |
| Protects      | Org management: users, groups, workspaces, billing, SSO, invitations         | Data operations: queries, catalogs, schedules, governance           |
| Identities    | Users, groups, service accounts                                              | Users, groups, service accounts, access tokens                      |
| Authorization | A fixed set of named permissions and built-in roles (Admin, Manager, Viewer) | Roles built from resource + action rules, attached by role bindings |

Identities and group memberships created on the Control Plane are synced to each workspace automatically, typically within about 30 seconds.

## Identity types

| Identity              | Where it lives            | Credential                    | Best for                                             |
| --------------------- | ------------------------- | ----------------------------- | ---------------------------------------------------- |
| User                  | Control Plane + workspace | SSO / OIDC session, OTP login | Humans - engineers, analysts, admins                 |
| Group                 | Control Plane + workspace | Membership only               | Assigning roles to a whole team at once              |
| Service Account       | A single workspace        | `e6sa_…` API key              | Workspace automation: CI/CD, scheduled jobs          |
| Personal Access Token | Workspace                 | `e6pat_…` API key             | Ad-hoc developer scripts tied to a user identity     |
| Support User          | Control Plane + workspace | e6data SSO                    | e6data engineer assistance, with alias-based privacy |

For how these credentials are created, used, and rotated, see [Access tokens](/query-engine/guides/security/access-tokens.md). For e6data engineer access, see [Support access](/query-engine/guides/security/support-access.md).

## Where to go next

| If you want to…                                          | Go to                                                                                                                                       |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Understand the permission grammar before designing roles | [Control Plane vs Compute Plane permissions](/query-engine/guides/security/identity-and-rbac/control-plane-vs-compute-plane-permissions.md) |
| Manage human and machine identities                      | [Users, groups, and service accounts](/query-engine/guides/security/identity-and-rbac/users-groups-service-accounts.md)                     |
| Assign roles and permissions                             | [Roles and permissions](/query-engine/guides/security/identity-and-rbac/roles-and-permissions.md)                                           |
| Generate an API key or token                             | [Access tokens](/query-engine/guides/security/access-tokens.md)                                                                             |

## See also

* [Access tokens](/query-engine/guides/security/access-tokens.md) - personal access tokens and service account keys.
* [Support access](/query-engine/guides/security/support-access.md) - e6data engineer access with per-tenant alias privacy.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/guides/security/identity-and-rbac.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.