> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamnative.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SQL Workspaces Access Control

> Understand the cloud resource and SQLWorkspace engine permission layers for SQL Workspaces.

SQL Workspaces use separate permission layers for cloud resources and SQLWorkspace engine operations.

| Layer                          | Controls                                                                                              |
| ------------------------------ | ----------------------------------------------------------------------------------------------------- |
| **Cloud resource access**      | Who can view, create, manage, and delete SQLWorkspace and SQLCatalog resources in StreamNative Cloud. |
| **SQLWorkspace engine access** | What a SQL identity can query, create, change, or administer inside the engine.                       |

Permission in one layer does not automatically grant the same level of permission in the other. For example, a user who can manage a SQLWorkspace in the Cloud Console is not necessarily an administrator inside its SQLWorkspace engine.

## Private Preview administrator mapping

During Private Preview, user subjects bound to the organization-level Organization Admin role (`org-admin`) are synchronized as SQLWorkspace engine superusers. The legacy `admin` role is treated the same way. Other cloud roles and service-account subjects are not included in this mapping.

The same engine permissions apply whether a user submits SQL through SQL Studio or a native PostgreSQL client.

<CardGroup cols={2}>
  <Card title="Cloud resource access" icon="cloud" href="/sql/access-control/cloud-resource-access">
    Understand access to SQLWorkspace and SQLCatalog resources.
  </Card>

  <Card title="SQLWorkspace engine access" icon="database" href="/sql/access-control/sql-engine-access">
    Understand SQL identities and engine administrator access.
  </Card>
</CardGroup>