# How access works (/access/how-access-works)
The two layers that decide which features you can open and which data you can read, and when a change takes effect.
Two separate things decide what you can do in Databaas: **which features you can open**, and
**which data you can read**. They are granted in different places, and neither implies the other.
You sign in once. From there, two independent checks run — one when you open a feature, one on every
query you make.
## Two kinds of access
| | Access to features | Access to data |
| --- | --- | --- |
| **Controls** | Whether Notebooks, Dashboards, Pipelines and the admin screens open at all. | Which warehouses, namespaces and tables you can read. |
| **Granted in** | **Access control** in the portal. | The **Permissions** tab of a warehouse, namespace or table in the [Data Catalog](/catalog/data-permissions). |
| **Granularity** | [Five permissions](/access/permissions-reference), each platform-wide. | Per warehouse, namespace or table, to a person, a catalog role or an application. |
| **Who changes it** | Anyone with **Administer platform**. | Anyone with **Manage grants** or ownership on that object. |
Opening a feature is not the same as reading data inside it. With **Use dashboards** you can open
Superset and see every chart listed, but a chart built on data you have no grant for returns an error
instead of rows.
## How a request is decided
You sign in once through single sign-on — with a Databaas account, or with your organisation's own
account where your instance is connected to it. Each feature checks whether you may open it, and every
query is then authorised as you, against your own data grants. Pipelines work the same way under
their own application identity:
## When a change takes effect
- **Feature permissions are checked live**, on every request — no sign-out. They are cached briefly
(a change can take about ten seconds to show), so wait around fifteen seconds and reload before
concluding a change did not land.
- **Data permissions are checked per query.** A new grant applies to your next query; in the Data
Catalog, use **Check again** on the "No rights yet" screen rather than reloading.
- **Notebooks is checked at sign-in.** A revoke does not stop a running notebook server, and a new
grant applies the next time you sign in to Notebooks.
## Who grants what
| Ask | For |
| --- | --- |
| A platform administrator | The five feature permissions, roles, and role membership. |
| A catalog administrator, or whoever owns the warehouse or namespace | Read or write access to a warehouse, namespace or table, for a person, a catalog role or a pipeline's application identity. |
Granting data needs rights on the catalog object itself, which a platform administrator does not
automatically hold — so the two are not always the same person.
The five permissions, what each unlocks, and where each is enforced.
The admin screens: granting to a person, and granting through a role.
Grants on warehouses, namespaces and tables.