Skip to main content
e6data has two distinct access-control systems. They’re easy to confuse because both restrict access, but they protect different things and are configured in different places.

​
Two systems, two questions

Platform RBAC is described in Identity and RBAC; data governance in Data governance.

​
How they combine

To query data, a user needs both:
  1. A role that allows running queries on the relevant clusters and catalogs (platform RBAC).
  2. A catalog privilege that grants access to the specific data (data governance).
Having one without the other isn’t enough. A user with a query-running role but no catalog privilege can connect and submit queries, but reads are denied by the catalog’s deny-by-default policy. Conversely, a catalog privilege grants nothing if the user has no role that lets them query at all.

​
Worked example

A BI analyst should run dashboards over the sales catalog but never see the salary column:
  1. Platform RBAC - assign a role that allows running queries (for example, Viewer), scoped to the BI cluster.
  2. Data governance - create an Allow privilege on sales for the analyst’s group, and a column-masking privilege on salary.
The analyst can now query sales (RBAC permits it) and sees every column except salary, which is masked (governance enforces it).

​
See also

Last modified on September 29, 2026