> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Warehouse access control - Docs

Copy page

# Warehouse access control - Docs

You can restrict who can query synced or self-managed warehouse tables, views, and [materialized views](/docs/data-warehouse/views/materialize.md). Denied tables and views are removed from the [HogQL](/docs/hogql.md) schema and can't be queried from any surface, including the SQL editor, [PostHog AI](/docs/posthog-ai.md), and MCP.

## Access levels

Warehouse sources, tables, and views use the same four levels as other resources:

-   **No access** – Hidden and can't be queried
-   **Viewer** – Can query, but can't sync, delete, or reconfigure
-   **Editor** – Can query, change source configuration, and edit table or view metadata
-   **Manager** – Can change access controls

## Restrict all sources, tables, or views

In project [access control settings](https://app.posthog.com/settings/project-access), you can restrict:

-   **Managed data warehouse sources** – Applies to external sources and the tables they sync. It doesn't apply to self-managed tables.
-   **Data warehouse tables and views** – Applies to all tables and views, including self-managed tables.

![Access control settings for managed data warehouse sources and data warehouse tables and views](https://res.cloudinary.com/dmukukwp6/image/upload/q_auto,f_auto/warehouse_resource_access_control_light_1f01796d71.png)![Access control settings for managed data warehouse sources and data warehouse tables and views](https://res.cloudinary.com/dmukukwp6/image/upload/q_auto,f_auto/warehouse_resource_access_control_dark_b658dfe756.png)

## Restrict a specific source

Open a source and select **Access control** to restrict the source and every table it syncs. A member or role override on a specific table can grant access to that table without granting access to the rest of the source.

![Access control settings for a specific data warehouse source](https://res.cloudinary.com/dmukukwp6/image/upload/q_auto,f_auto/source_access_control_light_dc6bd412f4.png)![Access control settings for a specific data warehouse source](https://res.cloudinary.com/dmukukwp6/image/upload/q_auto,f_auto/source_access_control_dark_39b0d2ea8a.png)

## Restrict a specific table or view

In the SQL editor, open the `...` menu beside a table, view, or materialized view in the schema tree and select **Access control**. You can also configure access and review all rules in the project's access control settings.

![Access control settings for a specific table or view in the SQL editor](https://res.cloudinary.com/dmukukwp6/image/upload/q_auto,f_auto/table_access_control_light_dd94e42bd6.png)![Access control settings for a specific table or view in the SQL editor](https://res.cloudinary.com/dmukukwp6/image/upload/q_auto,f_auto/table_access_control_dark_4471b415bc.png)

## How table access is resolved

For a table synced from a source, PostHog uses the most specific configured access rule in this order:

1.  Table override
2.  Source
3.  All data warehouse tables and views
4.  All managed data warehouse sources

This lets a source-level rule apply to every table it syncs while still allowing a member or role override on a specific table.

For example, you can set a Stripe source to **No access**, then give an analyst role **Viewer** access to `stripe_customers`. Analysts can query `stripe_customers`, but the rest of the Stripe tables stay hidden.

Source-level rules only apply to tables synced from [external sources](/docs/data-warehouse/sources.md).

## Give access to selected data with a materialized view

To share selected rows or columns without granting access to the entire table:

1.  Create a query that returns only the data you want to share
2.  Save it as a [materialized view](/docs/data-warehouse/views/materialize.md)
3.  Grant access to the materialized view
4.  Restrict access to the source or table you want to hide

A regular view doesn't provide this isolation. Its SQL reads the underlying table at query time, so the query fails if the member can't access that table.

## Feature availability

Warehouse access control is part of [access control](/docs/settings/access-control.md), available on the [Boost, Scale, and Enterprise plans](/platform-packages.md).

### Still have questions?

Ask PostHog AI

### Was this page useful?

HelpfulCould be better