Give a service account data access

A new service account reads no data until you give it access in Data Security, the same way you do for a user or a group. Every policy form has a Service Accounts field.

Prerequisites

• Your role includes the permission for the policy type: governance:permissions:grant (Access), governance:row_policies:write (Row level filter), or governance:masking_policies:write (Masking). The portal_admin and policy_manager roles have all three.
• The service account is Active. Disabled and deleted accounts cannot be selected.

Add the account to a policy

1. In the left sidebar, select Data Security → Security policies.

2. Open the tab of the policy type you need.

   Tab	Use it to	Details
   Access	Let the account read or change a catalog, schema, or table.	Grant data access with an access policy
   Row level filter	Limit the rows it sees in one table.	Filter rows with a row level filter policy
   Masking	Hide the values of a column.	Mask columns with a masking policy

3. Create a policy, or open an existing one.

4. In Service Accounts, select the account.

5. Select Create or Save.

The account can use the new access within about 1 minute.

Give the account only what its job needs. For example, a dashboard that reads one schema needs SELECT on that schema, not on the whole catalog.

Remove access

Open the policy, remove the account from Service Accounts, and select Save. See Edit, deactivate, or delete a policy.

To block the account everywhere at once, disable it instead. See Disable, enable, or delete a service account.

What happens to policies when the status changes

Status change	Effect on policies
Disable or Delete	The account loses all its access. It stays listed in its policies.
Enable	The account gets back the access from those policies.

Find the policies of a service account

On the Access tab, choose the account in All service account to show only its policies.

Next steps

• Data Security overview.