> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data access policies

> Apply column masking and row filtering to control which data users can see within a catalog.

Data access policies control which data users can see within a catalog, beyond catalog-level access. e6data supports two policy types: **column masking** (obscure sensitive column values) and **row filtering** (limit which rows a user can see). Both are created from a catalog's **Privilege** tab.

## Column masking

Column masking obscures sensitive data in specific columns from users who lack the appropriate privileges. Authorized users see the full data; others see a masked version. Supported masking types:

* **Mask** - replace the entire value with placeholder characters (regex replacement).
* **Mask first 4 characters** - keep the first four characters, mask the rest.
* **Mask last 4 characters** - keep all but the last four characters.
* **Hash (SHA-256)** - replace the value with an irreversible SHA-256 hash.

### Create a column-masking privilege

1. Navigate to **Catalogs** and click the desired catalog.
2. Select the **Privilege** tab.
3. Click **Create Privileges** and give the privilege a name (and optional description).
4. Select **Column masking** as the privilege type.
5. Select the databases and tables.
6. Select the columns and the masking type for each.
7. Select the user(s) and group(s) the privilege applies to.
8. Click **Create**. The privilege appears in the Privileges list.

### Limitations

* Column masking applies only to string data types.
* For string fields with 4 characters, `show_first_4` and `show_last_4` display the field unmasked.
* When masked columns are used in string functions, governance applies the string function first, then masks the result.
* Masking is not supported for values with special characters.
* Masking of values in `json_value` functions is not supported. If a masked column is aggregated, the final output is not masked.

## Row filtering

Row filtering limits which rows a user can see based on a condition - useful when different users need access to the same dataset at different scopes (for example, sales reps seeing only their assigned customers).

### Create a row-filter privilege

1. Navigate to **Catalogs** and click the desired catalog.
2. Select the **Privilege** tab.
3. Click **Create Privileges** and give the privilege a name (and optional description).
4. Select **Row filter** as the privilege type.
5. Select the databases.
6. Select the table and enter the filter expression (for example, `cc_employees=6879074`).
7. Select the user(s) and group(s) the privilege applies to.
8. Click **Create**.

The filter applies only to the selected table(s) and user(s) - other tables and users are unaffected.

### Limitations

* Subqueries in row-filter conditions are not yet supported.
* Row-filter conditions with aggregate functions are not yet supported (aggregations belong in the `HAVING` clause).
* For multiple row filters on the same table, only the first filter applies in a query that combines them.

## Edit or delete a policy

To edit, click the three dots next to the privilege, select **Edit**, change the databases, tables, columns/expression, or assigned users and groups, and click **Update**. To delete, select **Delete** from the same menu and confirm by typing `Delete`.

## See also

* [Governance overview](/query/governance)
* [Catalog-level access control](/query/governance/catalog-access-control)
* [Identity and RBAC](/platform/identity)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.