## Block data access

URL: https://docs.atlan.com/product/capabilities/governance/custom-metadata/how-tos/disable-data-access

> Block users from querying or previewing data in Atlan at different levels: workspace-wide, by connection, by specific asset, or by tag.

Block users from querying or previewing data in Atlan at four levels of scope: across the whole workspace, for a single connection, for specific assets, or for every asset carrying a sensitivity tag. Pick the method whose scope matches what you want to block, and note that an explicit deny always wins over every grant.

## Prerequisites

Before you begin, make sure:

- You are an **admin** in Atlan. All four methods require admin access.
- You have **connection admin** access on the relevant source, needed for connection-level and asset-level blocking.

## Block data access

Pick the scope that matches what you want to block. An explicit deny always wins over every grant, including the default access of a connection admin.

**Block all querying across the workspace** by turning off data exploration:

1. In your Atlan workspace, go to **Settings → Labs**. If you are using the **Old UI (Classic)**, go to **Admin → Labs** instead.
2. Toggle off **Data Exploration**. Users can still preview sample data.

**Block a narrower scope:**

- **By connection:** when setting up or editing the connection's crawler, set **Allow SQL Query** to **No** (and **Allow Data Preview** to **No** for sample data). This blocks querying and preview for that entire source.
 - Some connectors need a minimum data-access level to crawl metadata, so check the connector's setup guide before removing access.
- **By asset:** [create a persona](https://docs.atlan.com/llms/governance/access-control/create-a-persona/llms.txt) with a [data policy](https://docs.atlan.com/llms/governance/access-control/create-a-persona/llms.txt) that explicitly denies access, then add the affected users. Use an explicit deny so it also blocks connection admins; an implicit deny (no policy) does not.
- **By tag:** [create a purpose](https://docs.atlan.com/llms/governance/access-control/create-a-purpose/llms.txt) on the tag with a data policy that denies query access. If any column on an asset carries the tag, the whole asset is blocked, and the same rule covers previews.

## Need help?

If a block isn't taking effect, the usual cause is an implicit deny instead of an explicit one: only an explicit deny stops connection admins from querying or previewing. For tag-based blocks, also confirm the asset carries the tag you targeted. Contact [**Atlan Support**](https://docs.atlan.com/support/submit-request) if the issue persists.

## See also

- [Create a persona](https://docs.atlan.com/llms/governance/access-control/create-a-persona/llms.txt): Build a persona with a data policy to block specific assets.
- [Create a purpose](https://docs.atlan.com/llms/governance/access-control/create-a-purpose/llms.txt): Block by tag across every asset that carries it.
- [How access policies combine](https://docs.atlan.com/llms/governance/access-control/what-are-purposes/llms.txt): Why an explicit deny wins over every grant, including connection admins.

---