clickzetta-access-control

RBAC and dynamic data masking in ClickZetta Lakehouse are set up by creating roles, applying SQL-based GRANT/REVOKE, and binding masking policies using current_user/current_roles functions to enforce least-privilege access.

Column-level security for workspace management works by binding dynamic masking policies to sensitive table columns, executing masking functions during queries to ensure compliant read access based on current user roles.

User onboarding and role management in ClickZetta use SQL-based CREATE ROLE, GRANT, and REVOKE statements to assign predefined or custom roles like workspace_analyst, controlling instance and workspace permissions.

Yes, dynamic data masking can be applied to specific table columns for new workspace users by binding masking policies to sensitive columns, ensuring roles like workspace_analyst receive masked data during query execution.

ClickZetta access control supports security governance with both predefined and custom roles, allowing administrators to define specific permissions and apply GRANT/REVOKE across instances and workspaces for centralized management.

SHOW GRANTS in ClickZetta displays current permissions for users and roles, but does not modify access control; you must use separate SQL-based GRANT and REVOKE statements to actively change role privileges.