# Author a Restricted Subscription Policy

Data owners who are not governors can write restricted [subscription policies](https://documentation.immuta.com/2024.2/secure-your-data/authoring-policies-in-secure/section-contents/reference-guides/subscription-policies) and [data policies](https://documentation.immuta.com/2024.2/secure-your-data/authoring-policies-in-secure/data-policies/data-policy-overview), which allow them to enforce policies on multiple data sources simultaneously, eliminating the need to write redundant [local policies](https://documentation.immuta.com/2024.2/secure-your-data/authoring-policies-in-secure/policies-explained).

Unlike global policies, the application of these policies is restricted to the data sources owned by the users or groups specified in the policy and will change as users' ownerships change.

## Write access policy requirements

{% hint style="info" %}
**Private preview**

[Write policies](https://documentation.immuta.com/2024.2/secure-your-data/authoring-policies-in-secure/section-contents/reference-guides/subscription-access-types) are only available to select accounts. Contact your Immuta representative to enable this feature.
{% endhint %}

* At least one of the following permissions is required to manage write policies:
  * CREATE\_DATA\_SOURCE Immuta permission (to create local write policies)
  * GOVERNANCE Immuta permission (to create local or global write policies)
  * MANAGE\_POLICIES domain permission (to create global write policies)
* [Databricks Unity Catalog](https://documentation.immuta.com/2024.2/data-and-integrations/databricks-unity-catalog/unity-catalog-overview), [Snowflake](https://documentation.immuta.com/2024.2/data-and-integrations/snowflake/reference-guides/snowflake-overview), or [Starburst (Trino)](https://documentation.immuta.com/2024.2/data-and-integrations/starburst-trino/trino-overview) integration
* [Snowflake table grants enabled](https://documentation.immuta.com/2024.2/data-and-integrations/snowflake/how-to-guides/integration-settings/table-grants) (for Snowflake integrations)

### Enable write access policies

Once support for this feature has been enabled in your Immuta tenant,

1. Navigate to the **App Settings** page.
2. Scroll to the **Preview Features** section.
3. Click the **Enable Write Policies** checkbox and **Save** your changes.

## Create a restricted subscription policy

1. Click the **Policies** in the left sidebar and select **Subscription Policies**.
2. Click **Add Policy**, complete the **Enter Name** field.
3. Select the access type:
   * **Read Access**: Control who can view the data source.
   * **Write Access**: Control who can view and modify data in the data source.
4. Select the level of **access restriction** you would like to apply to your data sources:
   * **Allow anyone**: Check the **Require Manual Subscription** checkbox to turn off automatic subscription. Enabling this feature will require users to manually subscribe to the data source if they meet the policy.
   * **Allow anyone who asks (and is approved)**:
     1. Click **Anyone** or **An individual selected by user** from the first dropdown menu in the subscription policy builder.

        *Note: If you choose **An individual selected by user**, when users request access to a data source they will be prompted to identify an approver with the permission specified in the policy and how they plan to use the data.*
     2. Select the **Owner (of the data source)**, **USER\_ADMIN**, **GOVERNANCE**, or **AUDIT** permission from the subsequent dropdown menu.

        *Note: You can add more than one approving party by selecting **+ Add Another Approver**.*
   * **Allow users with specific groups/attributes**:
     1. Choose the condition that will drive the policy: when user **is a member of a group** or **possesses attribute**. *Note: To build more complex policies than the builder allows, follow the* [*Advanced rules DSL*](https://documentation.immuta.com/2024.2/secure-your-data/authoring-policies-in-secure/section-contents/how-to-guides/advanced-dsl-policies) *policy guide.*
     2. Use the subsequent dropdown to choose the group or attribute for your condition. You can add more than one condition by selecting **+ Add Another Condition**. The dropdown menu in the subscription policy builder contains conjunctions for your policy. If you select **or**, only one of your conditions must apply to a user for them to see the data. If you select **and**, all of the conditions must apply.
     3. Check the **Require Manual Subscription** checkbox to turn off automatic subscription. Enabling this feature will require users to manually subscribe to the data source if they meet the policy.
     4. If you would like to make your data source visible in the list of all data sources in the UI to all users, click the **Allow Data Source Discovery** checkbox. Otherwise, this data source will not be discoverable by users who do not meet the criteria established in the policy.
     5. If you would like users to have the ability to request approval to the data source, even if they do not have the required attributes or traits, check the **Request Approval to Access** checkbox. This will require an approver with permissions to be set.
     6. Select how you want Immuta to merge multiple global subscription policies that apply to a single data source.

        * **Always Required**: Users must meet all the conditions outlined in each policy to get access (i.e., the conditions of the policies are combined with `AND`).
        * **Share Responsibility**: Users need to meet the condition of at least one policy that applies (i.e., the conditions of the policies are combined with `OR`).

        *Note: To make this option selected by default, see* [*the app settings page*](https://documentation.immuta.com/2024.2/application-settings/how-to-guides/config-builder-guide#default-subscription-merge-options)*.*
   * **Allow individually selected users**
5. From the **Where should this policy be applied** dropdown menu, select **When selected by data owners**, **On all data sources**, or **On data sources**. If you selected **On data sources**, finish the condition in one of the following ways:
   * **tagged**: Select this option and then search for **tags** in the subsequent dropdown menu.
   * **with columns tagged**: Select this option and then search for **tags** in the subsequent dropdown menu.
   * **with column names spelled like**: Select this option, and then enter a **regex** and choose a **modifier** in the subsequent fields.
   * **in server**: Select this option and then choose a **server** from the subsequent dropdown menu to apply the policy to data sources that share this connection string.
   * **created between**: Select this option and then choose a **start date** and an **end date** in the subsequent dropdown menus.
6. Beneath **Whose Data Sources should this policy be restricted to**, add **users** or **groups** to the policy restriction by typing in the text fields and selecting from the dropdown menus that appear.
7. Opt to complete the **Enter Rationale for Policy (Optional)** field.
8. Click **Create Policy**, and then click **Activate Policy** or **Stage Policy**.