Identity and RBAC

How e6data controls who can access your platform and what they can do, across the Control Plane and the Compute Plane.

e6data controls who can access your data platform and what they are allowed to do across two planes: the Control Plane (organization-wide management) and the Compute Plane (per-workspace data and query operations).

This section is for organization admins, security and compliance teams, and developers integrating with the e6data APIs.

The two-plane model

The Control Plane decides whether a person or service belongs to your organization at all. The Compute Plane decides what they can do inside a specific workspace. Each plane has its own permission vocabulary because each protects a different surface, and the two are linked by an automatic sync that propagates identities, group memberships, and role assignments from the Control Plane to each workspace.

	Control Plane	Compute Plane
Scope	Your whole organization	A single workspace
Protects	Org management: users, groups, workspaces, billing, SSO, invitations	Data operations: queries, catalogs, schedules, governance
Identities	Users, groups, service accounts	Users, groups, service accounts, access tokens
Authorization	A fixed set of named permissions and built-in roles (Admin, Manager, Viewer)	Roles built from resource + action rules, attached by role bindings

Identities and group memberships created on the Control Plane are synced to each workspace automatically, typically within about 30 seconds.

Identity types

Identity	Where it lives	Credential	Best for
User	Control Plane + workspace	SSO / OIDC session, OTP login	Humans - engineers, analysts, admins
Group	Control Plane + workspace	Membership only	Assigning roles to a whole team at once
Service Account	A single workspace	e6sa_… API key	Workspace automation: CI/CD, scheduled jobs
Personal Access Token	Workspace	e6pat_… API key	Ad-hoc developer scripts tied to a user identity
Support User	Control Plane + workspace	e6data SSO	e6data engineer assistance, with alias-based privacy

For how these credentials are created, used, and rotated, see Access tokens. For e6data engineer access, see Support access.

Where to go next

If you want to…	Go to
Understand the permission grammar before designing roles	Control Plane vs Compute Plane permissions
Manage human and machine identities	Users, groups, and service accounts
Assign roles and permissions	Roles and permissions
Generate an API key or token	Access tokens

See also

• Access tokens - personal access tokens and service account keys.
• Support access - e6data engineer access with per-tenant alias privacy.