Access

Access holds Nexatron's own "who sees what" rules. Snowflake and Salesforce questions run as each person, so those sources' own policies (Snowflake roles, row access and masking policies, Salesforce sharing) apply first. These rules add to them; they never widen what a source allows. They matter most for sources that do not run as each person.

The page has four cards; select Manage on one to open it.

Row rules

Row rules limits which rows a role or person sees, for example one region. There is no admin bypass.

Column masking

Column masking hides a column's real values from the roles that should not see them, in every answer, export and API response. Select New rule, name the table and column, choose how to mask it, and list the roles under Mask for these roles: leave it empty to mask the column for everyone. Select Create rule. Each rule can be paused or deleted.

Data classification

Data classification records what a column is (Public, Internal, Confidential or Restricted) so every answer computed from it says so wherever it ends up, including exports and shared links. Select Classify a column, name the table and column, choose the level and give a justification, then Classify column.

A classification is not an access control: nothing is refused because of a label. To hide a column, add a masking rule; to limit rows, add a row rule.

Write a rule in your own words

Write a rule in your own words (select Open) lets you describe a rule, such as "Marketing can't see salary", and review what it becomes before saving it.