> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamnative.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SQLWorkspace Engine Access

> Understand the cloud-user and machine-to-machine identity models for a SQLWorkspace engine.

SQLWorkspace engine access controls what a SQL identity can query or administer inside a workspace.

<CardGroup cols={2}>
  <Card title="Cloud user access" icon="user" href="/sql/access-control/cloud-user-access">
    Understand how qualifying organization roles map cloud users to engine administrators.
  </Card>

  <Card title="Machine-to-machine access" icon="gear" href="/sql/access-control/machine-to-machine-access">
    Create dedicated engine users for applications and automation.
  </Card>
</CardGroup>

## Identity models

| Identity model     | Provisioning                                             | Typical use                 | Privileges                                             |
| ------------------ | -------------------------------------------------------- | --------------------------- | ------------------------------------------------------ |
| Cloud user         | Synchronized from a qualifying organization role binding | Interactive administration  | SQLWorkspace engine `SUPERUSER` during Private Preview |
| Machine-to-machine | Manually created by an engine administrator              | Applications and automation | Explicitly granted engine privileges                   |

## Query paths

SQL Studio and the native PostgreSQL endpoint are two connection paths to the same engine. Changing the client does not elevate permissions:

* SQL Studio uses the SQL identity associated with the authenticated experience.
* Native PostgreSQL clients use the supplied SQL username and password.
* The SQLWorkspace engine evaluates permissions for both paths.

Permission to manage a SQLWorkspace in StreamNative Cloud does not otherwise grant permission to query or administer its engine. See [Cloud Resource Access](/sql/access-control/cloud-resource-access) for the separate cloud permission layer.