What governance covers
e6data offers three privilege types, all created from a catalog’s Privilege tab:
You can also integrate an external policy engine - Apache Ranger, OPA, Unity, or Lake Formation - by enabling Governance when you register a catalog.
How it relates to platform RBAC
Workspace roles (Admin, Manager, Viewer) govern platform actions - creating clusters, registering catalogs, managing users. Data governance governs which rows, columns, and tables a user can read once they can query a catalog. The two work together: a user needs both a role that lets them run queries and a catalog privilege that grants access to the data. See Relationship to platform RBAC.Key behaviors
- Deny-by-default. A catalog with no privileges denies all access; you grant access explicitly.
- Deny precedence. Where both allow and deny privileges could apply, deny always wins.
- Propagation delay. Allow up to 60 seconds for a new or changed privilege to take effect in the SQL engine.
- Additive allows. A user or group can belong to multiple privileges; if any allow grants access (and no deny applies), the query runs.
In this section
- Catalog-level access control - allow/deny privileges across catalog, database, table, and column.
- Data access policies - column masking and row filtering.
- Relationship to platform RBAC - governance vs. workspace roles.