> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamnative.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud User Access

> Understand how StreamNative Cloud users become SQLWorkspace engine administrators.

During Private Preview, StreamNative Cloud can synchronize qualifying human users as SQLWorkspace engine administrators.

## Administrator mapping

User subjects bound to the organization-level Organization Admin role (`org-admin`) are synchronized as SQLWorkspace engine `SUPERUSER` identities. The legacy `admin` role is treated the same way.

Other cloud roles and service-account subjects are not included in this mapping. A cloud role that permits SQLWorkspace management does not otherwise grant permissions inside the engine.

Engine administrator privileges are required for operations such as managing engine users and privileges. A `SUPERUSER` can also perform object operations that another SQL identity is not permitted to perform.

## Identity lifecycle

When a qualifying user is added to an organization role binding, each SQLWorkspace reconciles that user into its engine. When the user is removed from all qualifying bindings, the managed engine identity is reconciled without `SUPERUSER` privileges.

Manage the cloud role binding instead of manually changing the synchronized user's administrator status inside the engine.

## Query access

Cloud users can submit SQL through SQL Studio. If a cloud user connects through the native PostgreSQL endpoint, the engine evaluates the supplied SQL username and password with the same engine permissions.

For applications and automation, create a separate engine identity instead of sharing a human administrator's credentials. See [Machine-to-Machine Access](/sql/access-control/machine-to-machine-access).