> ## Documentation Index
> Fetch the complete documentation index at: https://private-7c7dfe99-vortex-format.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Does ClickHouse support row-level and column-level security?

> Learn about row-level and column-level access restrictions in ClickHouse and ClickHouse Cloud, and how to implement role-based access control (RBAC) with policies.

<h2 id="clickhouse-and-clickhouse-cloud-both-support-row-and-column-level-access-restrictions">
  ClickHouse and ClickHouse Cloud both support row and column-level access restrictions
</h2>

ClickHouse and ClickHouse Cloud both support row and column-level access restrictions for read-only users necessary to achieve a role-based access control (RBAC) model.

[Row Policies](/concepts/features/security/access-rights#row-policy-management) can be used to specify which rows will be returned to a read-only user when they query a table. ClickHouse Cloud is configured to enable the SQL-driven workflow by default. To leverage this workflow [CREATE](/reference/statements/create/user) a user, [GRANT](/reference/statements/grant) the user privileges on a table, then set the appropriate [ROW POLICY](/concepts/features/security/access-rights#row-policy-management). When the user performs a `SELECT * FROM table`, only rows allowed by the policy will be displayed.

Row policies filter the table whose data is read on that server. To filter queries that go through a [Distributed](/reference/engines/table-engines/special/distributed) table, create the policy on the underlying local table on each server of the cluster: a policy on the `Distributed` table itself cannot be applied to the query shipped to the remote servers, and such reads are rejected instead of silently returning unfiltered rows. The policy on the local table is not applied when the initiator ships an already-built read plan, so keep [`serialize_query_plan = 0`](/reference/settings/session-settings/serialize#serialize_query_plan) for users whose row policies must be enforced (see [issue #112891](https://github.com/ClickHouse/ClickHouse/issues/112891)).

Column-level restrictions may be specified directly using the [GRANT statement](/reference/statements/grant) to enable table-level access for users and roles. Users *may only* include columns for which they have access in a query. Selecting restricted columns from a table in which the user does not have access to all the specified columns, such as in the query `SELECT * FROM table`, will return an error stating the user has insufficient permissions.