> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://help.sigmacomputing.com/docs/restrict-access-to-data/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server. # Secure access to data in Sigma > Sigma offers several approaches to secure and manage access to data, including permissions, platform RBAC, RLS, CLS, and data isolation. Sigma supports different methods that you can use to secure and manage access to your data. Use them in different combinations to provide scalable and effective data security in Sigma. The options that make the most sense for your organization depend on how you plan to use Sigma, and where you prefer to restrict access to data. #### [Platform RBAC](#restrict-access-to-data-in-your-data-platform) Enforce the role-based access control already defined in your data platform. \ Recommended when your data platform already has RBAC or row access policies you don't want to duplicate in Sigma. #### [Tenant organizations](#isolate-data-in-separate-sigma-organizations) Isolate a group, groups, or users in a separate Sigma organization with its own connections, managed centrally by a parent organization.\ Recommended for use cases where isolating data is critical. #### [Restrict access to data in Sigma](#restrict-access-to-data-in-sigma) Grant data access permissions and set up row-level and column-level security rules directly in Sigma.\ Recommended as a baseline for every connection, or for granular access control enforced in Sigma. ## Restrict access to data in your data platform If you want to manage access restrictions in your data platform, use role-based access control (RBAC) already defined there instead of duplicating the logic in Sigma. Use one of the following methods when connecting to reuse the RBAC in your data platform: #### [OAuth](#use-oauth) Sigma authenticates each user to your data platform using their own identity. \ Recommended when each user has an account in both the data platform and Sigma. #### [Dynamically assign roles](#dynamically-assign-roles-with-a-user-attribute) Use a user attribute to specify the role Sigma uses to query your data platform on behalf of the current user. \ Recommended for connections that use key pair authentication. #### [Session and SQL variables](#use-session-and-sql-variables) Set session or SQL variables that Snowflake uses to drive row access policies. \ Recommended for Snowflake connections that use key pair authentication. ### Use OAuth If you [configure connection-level OAuth](/docs/configure-oauth), Sigma authenticates each user to your data platform using their own identity, so any RBAC or row access policies enforced by your data platform apply automatically. Each user must have an account in the data platform and in Sigma for connection-level OAuth to enforce RBAC in the data platform. ### Dynamically assign roles with a user attribute If a connection uses key pair authentication, you can use a user attribute to specify the role that Sigma uses to query your data platform on behalf of the current user. By setting up dynamic assignment of roles, your data platform's existing role-based security policies determine what data a given user can access. See [Dynamically assign roles used by a connection](/docs/dynamically-assign-roles-used-by-a-connection). ### Use session and SQL variables If you use a Snowflake connection with key pair authentication, you can set session or SQL variables that Snowflake uses to enforce row access policies. See [Specify session variables for a Snowflake connection](/docs/specify-session-variables-for-a-snowflake-connection). ## Isolate data in separate Sigma organizations If you isolate each customer's or business unit's data in a separate organization using [Sigma Tenants](/docs/multitenancy-at-sigma), you can ensure that unauthorized users can never access data that they do not have authorization to interact with. Sigma Tenants can be used in combination with data platform RBAC and restricting access to data in Sigma. > **Info** > > If you do not need to fully separate users, connections, authentication, AI providers, and branding for each customer or business unit, you can also use [version tags and source swapping](/docs/tag-a-document-version#swap-the-source-of-a-tagged-document-version) to isolate the data queried within a single Sigma organization. ## Restrict access to data in Sigma If you plan to manage access to data directly in Sigma, grant the relevant data access and set up appropriate row-level and column-level security rules: #### [Data access permissions](#grant-data-access-permissions) Control which users and teams can access a connection and the databases, schemas, and tables within it. Recommended as a baseline for every connection. Applies at the connection, database, schema, or table level, not to individual rows or columns, and cannot be combined with OAuth-enforced RBAC. #### [RLS and CLS](#apply-row-level-and-column-level-security) Restrict specific rows or columns of data in a data model based on user identity, team membership, or a user attribute. Recommended for granular access control enforced in Sigma. ## Grant data access permissions Data access permissions control which users and teams can access a connection and the databases, schemas, and tables within it. Access is additive, so permissions granted at a database or catalog level also apply to its schemas and objects. See [Data access overview](/docs/data-permissions-overview) and [Manage access to data and connections](/docs/manage-data-permissions). If you use OAuth to manage access to a connection, connection-level access grants still apply, but do not grant database, schema, or table-level data access permissions. ## Apply row-level and column-level security Use RLS and CLS to restrict access to specific rows or columns of data in a data model based on user identity, team membership, or an assigned user attribute value: * [Row-level security (RLS)](/docs/set-up-row-level-security) restricts specific rows of data. * [Column-level security (CLS)](/docs/column-level-security) restricts or masks entire columns of data. ## Related resources * [Data access overview](/docs/data-permissions-overview) * [Set up row-level security](/docs/set-up-row-level-security) * [Configure column-level security](/docs/column-level-security) * [Configure user attributes](/docs/user-attributes) * [About using OAuth with Sigma](/docs/configure-oauth) * [Sigma Tenants](/docs/multitenancy-at-sigma) > Official documentation and guidance for using Sigma to build AI apps, dashboards, and agents on governed warehouse data. ## Docs - [Set up row-level security](https://help.sigmacomputing.com/docs/set-up-row-level-security.md): Row-level security (RLS) restricts access to data based on the characteristics of the person viewing the data in Sigma. - [Configure column-level security](https://help.sigmacomputing.com/docs/column-level-security.md): Column-level security lets admins restrict or grant access to column-level data so sensitive information stays accessible to authorized users only.