> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Relationship to platform RBAC

> How data governance and platform RBAC differ and work together - who can do what vs. which data they can see.

e6data has two distinct access-control systems. They're easy to confuse because both restrict access, but they protect different things and are configured in different places.

## Two systems, two questions

| | Platform RBAC | Data governance |
| - | - | - |
| Answers | *Who can do what* | *Which data can they see* |
| Examples | Create a cluster, register a catalog, manage users, run queries | Read a specific table, see a masked column, see filtered rows |
| Built from | Roles (Admin, Manager, Viewer) and role bindings | Catalog privileges: access control, column masking, row filtering |
| Configured in | Access Control (Console) | A catalog's **Privilege** tab |
| Scope | Workspace and platform operations | Within a catalog (catalog → database → table → column) |
| Default | A new user has no roles until assigned | A new catalog denies all data access until a privilege grants it |

Platform RBAC is described in [Identity and RBAC](/platform/identity); data governance in [Data governance](/query/governance).

## How they combine

To query data, a user needs **both**:

1. A **role** that allows running queries on the relevant clusters and catalogs (platform RBAC).
2. A **catalog privilege** that grants access to the specific data (data governance).

Having one without the other isn't enough. A user with a query-running role but no catalog privilege can connect and submit queries, but reads are denied by the catalog's deny-by-default policy. Conversely, a catalog privilege grants nothing if the user has no role that lets them query at all.

## Worked example

A BI analyst should run dashboards over the `sales` catalog but never see the `salary` column:

1. **Platform RBAC** - assign a role that allows running queries (for example, Viewer), scoped to the BI cluster.
2. **Data governance** - create an Allow privilege on `sales` for the analyst's group, and a column-masking privilege on `salary`.

The analyst can now query `sales` (RBAC permits it) and sees every column except `salary`, which is masked (governance enforces it).

## See also

* [Data governance overview](/query/governance)
* [Catalog-level access control](/query/governance/catalog-access-control)
* [Roles and permissions](/platform/identity/roles-and-permissions)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.