Skip to main content

Data Access

You can use data access groups and policies to control which users can read, insert, update, or delete data in your Hive, at the schema, entity, or table level.

By default, every Hive comes with a set of access groups and policies for each of the user roles: Account Admin, Power User, and Standard User.

Hive Admins can create and manage groups and policies. Power Users and Standard Users can view the groups and policies they're assigned to.

Data Access Groups​

Data access groups link a set of users to one or more data access policies.

Each group has:

  • A set of members
  • One or more policies assigned to it

Data Access Policies​

Data access policies define a set of permissions that apply to one or more data access groups.

Each policy has:

  • A scope: Entire schema, Entity, or Table
  • A set of permissions: Read, Insert, Update, Delete (or All)

A user's effective access is the union of everything granted by the policies attached to their groups. Policies can only grant access, never take it away.

When a policy's scope is set at the schema or entity level, any tables added later are automatically covered.

Note: Data access policies control access to table data. Users can still see that a table exists and view its structure even without read access to its records.

If a user lacks read access to any table referenced by a Shape, they won't be able to access that Shape's records at all.