> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data governance overview

> How e6data governs access to data within a catalog - catalog-level access control, column masking, and row filtering, enforced deny-by-default.

Data governance controls **which data users can see** within a catalog, layered on top of the workspace roles that control *who can do what* (see [Identity and RBAC](/platform/identity)). Governance is enforced per catalog and is **deny-by-default**: when a catalog is created, no one can query its data until a privilege grants access.

## What governance covers

e6data offers three privilege types, all created from a catalog's **Privilege** tab:

| Privilege | What it does |
| - | - |
| [Catalog-level access control](/query/governance/catalog-access-control) | Allow or deny query access at the catalog, database, table, and column level. |
| Column masking | Obscure sensitive column values for users who lack access - see [Data access policies](/query/governance/data-access-policies). |
| Row filtering | Limit which rows a user can see based on a condition - see [Data access policies](/query/governance/data-access-policies). |

You can also integrate an external policy engine - Apache Ranger, OPA, Unity, or Lake Formation - by enabling **Governance** when you register a catalog.

## How it relates to platform RBAC

Workspace roles (Admin, Manager, Viewer) govern platform actions - creating clusters, registering catalogs, managing users. **Data governance** governs which rows, columns, and tables a user can read once they can query a catalog. The two work together: a user needs both a role that lets them run queries *and* a catalog privilege that grants access to the data. See [Relationship to platform RBAC](/query/governance/relationship-to-platform-rbac).

## Key behaviors

* **Deny-by-default.** A catalog with no privileges denies all access; you grant access explicitly.
* **Deny precedence.** Where both allow and deny privileges could apply, deny always wins.
* **Propagation delay.** Allow up to 60 seconds for a new or changed privilege to take effect in the SQL engine.
* **Additive allows.** A user or group can belong to multiple privileges; if any allow grants access (and no deny applies), the query runs.

## In this section

* [Catalog-level access control](/query/governance/catalog-access-control) - allow/deny privileges across catalog, database, table, and column.
* [Data access policies](/query/governance/data-access-policies) - column masking and row filtering.
* [Relationship to platform RBAC](/query/governance/relationship-to-platform-rbac) - governance vs. workspace roles.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.