> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamnative.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Resource Access

> Understand how StreamNative Cloud roles govern SQLWorkspace and SQLCatalog resources.

StreamNative Cloud role-based access control determines which SQLWorkspace and SQLCatalog resources a user can view and manage.

Cloud permissions apply to operations such as:

* Viewing SQLWorkspaces and their status.
* Creating and deleting a SQLWorkspace.
* Adding or removing a SQLCatalog.
* Viewing workspace connection information.
* Opening the SQL experience in the Cloud Console.

The Cloud Console displays only the resources and actions allowed by the user's assigned roles. Follow least-privilege practices when granting access.

For general StreamNative Cloud role and role-binding concepts, see [RBAC overview](/cloud/security/access/rbac/rbac-overview).

## Cloud roles and engine roles are separate

A cloud role that permits SQLWorkspace management does not generally grant the same permissions inside the SQLWorkspace engine.

During Private Preview, there is one explicit mapping: user subjects bound to the organization-level Organization Admin role (`org-admin`), or its legacy `admin` equivalent, are synchronized as engine superusers. Other cloud roles and service-account subjects are not included. For details, see [Cloud User Access](/sql/access-control/cloud-user-access).