# Data access

Data access decides what each person can see and change in <Term id="nexus">Nexus</Term>. Each member reaches everything, or only what you give them.

<Callout type="info">
Owners and admins (see <Term id="roles">roles</Term>) always reach everything, and cannot be limited.
</Callout>

## Before you start [#before-you-start]

- Only owners and admins can change access.
- Folders are shared from the folder itself, with **Who can see this**. See [Object storage](/docs/data/object-storage#share-a-folder).

## The access levels [#the-access-levels]

Tick the levels a person needs.

| Level in the app | In code | What it allows |
| --- | --- | --- |
| **Know it exists** | `exists` | See its name in lists |
| **See its columns** | `structure` | See column names and types |
| **Read its data** | `read` | Read rows and query them |
| **Change its data** | `write` | Add, change and delete rows |
| **Change its structure** | `change_structure` | Add, rename and remove columns, make and delete tables |
| **Give this access to others** | `grant` | Pass the same access on |

Access can be given on a <Term id="schema">schema</Term> (every table in it), a **Table** or a **Connection**.

## Limit a member to what they are given [#limit-a-member-to-what-they-are-given]

<ForEveryone>

<Steps>
<Step>
### Open Data access [#open-data-access]
Go to <AppLink to="settings" /> and open **Data access**.
</Step>
<Step>
### Set what the member reaches [#set-what-the-member-reaches]
Under **What each member reaches**, change the member from **Everything** to **Only what is given below**.
</Step>
</Steps>

<Screenshot src="/docs/_media/manage-connections-by-toggle-on-off-per-project.png" alt="The Data access page in Settings" />

</ForEveryone>

<ForDevelopers>

```python
nx.access.limit_member("USER_ID")
nx.access.limit_member("USER_ID", granted_only=False)
```

</ForDevelopers>

## Give access [#give-access]

<ForEveryone>

<Steps>
<Step>
### Choose who and what [#choose-who-and-what]
Under **Give access**, pick the **Member**, the kind (**Schema**, **Table** or **Connection**), and type its name, such as `sales` or `sales.orders`.
</Step>
<Step>
### Choose the levels [#choose-the-levels]
Tick the levels the person needs.
</Step>
<Step>
### Set the options [#set-the-options]
Tick **Keep their changes in their own copy** to keep their writes apart from the live table. Set an end date for temporary access.
</Step>
<Step>
### Give it [#give-it]
Select **Give access**. It appears under **Access given**, with **Their changes** (**Go live** or **Stay in their own copy**) and **Until**.
</Step>
</Steps>

</ForEveryone>

<ForDevelopers>

`give()` sets the whole grant for one person on one resource, replacing what was there.

```python title="give_access.py"
from klarety import Nexus

with Nexus.connect() as nx:
    nx.access.give(
        "person",
        "USER_ID",
        "table",
        "sales.orders",
        ["exists", "structure", "read"],
        columns={"email": "hashed", "phone": "hidden"},
        expires_at="2026-12-31T23:59:59Z",
    )
    for grant in nx.access.grants(principal_kind="person", principal_id="USER_ID"):
        print(grant)
```

| Option | Values |
| --- | --- |
| Who (`principal_kind`) | `person`, `project`, `key` |
| What (`resource_kind`) | `schema`, `table`, `folder`, `connection` |
| `where` | `main` (changes go live) or `own_branch` (their own copy) |
| `columns` | per column: `hidden`, `hashed` or `nulled` |

Column options are available from code only.

</ForDevelopers>

## Take back access [#take-back-access]

<ForEveryone>

Under **Access given**, select **Take back** on the row.

</ForEveryone>

<ForDevelopers>

```python
nx.access.take_back("person", "USER_ID", "table", "sales.orders")
```

</ForDevelopers>

## What can go wrong [#what-can-go-wrong]

<Accordions>
<Accordion title="A member still sees everything">
Their row under **What each member reaches** is set to **Everything**. Change it to **Only what is given below**.
</Accordion>
<Accordion title="A query is refused">
The person lacks a level, often **Read its data** on one table the query names. Add it.
</Accordion>
<Accordion title="You cannot change access">
Only owners and admins can. Ask one of them.
</Accordion>
</Accordions>

## Where to go next [#where-to-go-next]

- [Members](/docs/workspace/members): roles and invitations.
- [Object storage](/docs/data/object-storage): share folders.
- [Query with SQL](/docs/data/sql-editor): what access means for queries.