# Customize Read and Write Access Policies for Starburst (Trino)

{% hint style="info" %}
**Private preview**: Write policies are available to select accounts. Contact your Immuta representative to enable this feature.
{% endhint %}

## Requirements

* Starburst (Trino) version 438 or newer
* Write policies for Starburst (Trino) enabled. Contact your Immuta representative to get this feature enabled on your account.

## Configuration options

In its default setting, the Starburst (Trino) integration's write access value controls the authorization of SQL operations that perform data modification (such as `INSERT`, `UPDATE`, `DELETE`, `MERGE`, and `TRUNCATE`). However, administrators can allow table modification operations (such as `ALTER` and `DROP` tables) to be authorized as write operations. Two locations allow administrators to specify how [read and write access policies](/saas/govern/secure-your-data/authoring-policies-in-secure/section-contents/reference-guides/subscription-access-types.md) are applied to data in Starburst (Trino). Select one or both of the options below to customize these settings. If the `access-control.properties` file is used, it may override the policies configured in the Immuta web service.

* **Immuta web service**: Configure write policies in the Immuta web service to allow all Starburst (Trino) clusters targeting that Immuta tenant to receive the same write policy configuration for data sources. This configuration will only affect tables or views registered as Immuta data sources.
* **Starburst (Trino) cluster**: Configure write policies using the `access-control.properties` file in [Starburst](/saas/configuration/integrations/starburst-trino/how-to-guides/configure.md#id-2-configure-the-immuta-system-access-control-plugin-in-starburst) or [Trino](/saas/configuration/integrations/starburst-trino/how-to-guides/configure.md#id-2-configure-the-immuta-system-access-control-plugin-in-trino) to broadly customize access for Immuta users on a specific cluster. This configuration file takes precedence over write policies passed from the Immuta web service. Use this option if all Immuta users should have the same level of access to tables regardless of the write policy setting in the Immuta web service.

### Immuta web service configuration

Contact your Immuta representative to configure read and write access in the Immuta web service if all Starburst (Trino) data source operations should be affected identically across Starburst (Trino) clusters connected to your Immuta tenant. A configuration example is provided below.

#### Configuration example

The following example maps `WRITE` to `READ`, `WRITE` and `OWN` permissions and `READ` to just `READ`. Both `READ` and `WRITE` permissions should always include `READ`:

```yaml
accessGrantMapping:
  WRITE: ['READ', 'WRITE', 'OWN']
  READ: ['READ']
```

Given the above configuration, when a user gets write access to a Starburst (Trino) data source, they will have both data and table modification permissions on that data source. See the Starburst (Trino) privileges section of the [Subscription policy access types guide](/saas/govern/secure-your-data/authoring-policies-in-secure/section-contents/reference-guides/subscription-access-types.md#granting-starburst-trino-privileges) for details about these operations.

### Cluster configuration

Modify one or both properties below in the **`immuta-access-control.properties`** file in your Trino or Starburst cluster to customize the behavior of read or write access policies for all users:

* **`immuta.allowed.immuta.datasource.operations`**: This property governs objects (catalogs, schemas, tables, etc.) that are registered as data sources in Immuta. These permissions apply to all querying users except for administrators defined in `immuta.user.admin` (who get all permissions).
  * `READ`: Grants `SELECT` on tables or views; grants `SHOW` on tables, views, or columns
  * `WRITE`: Grants `INSERT`, `UPDATE`, `DELETE`, `MERGE`, or `TRUNCATE` on tables; grants `REFRESH` on materialized views.
  * `OWN`: Grants `ALTER` and `DROP` on tables; grants `SET` on comments and properties
* **`immuta.allowed.non.immuta.datasource.operations`**: This property governs objects (catalogs, schemas, tables, etc.) that are not registered as data sources in Immuta. Use all or a combination of the following access values:
  * `READ`: Grants `SELECT` on tables or views; grants `SHOW` on tables, views, or columns
  * `WRITE`: Grants `INSERT`, `UPDATE`, `DELETE`, `MERGE`, or `TRUNCATE` on tables; grants `REFRESH` on materialized views.
  * `OWN`: Grants `ALTER` and `DROP` on tables; grants `SET` on comments and properties
  * `CREATE`: Grants `CREATE` on catalogs, schema, tables, and views. *This is the only property that can allow `CREATE` permissions, since `CREATE` is enforced on new objects that do not exist in Starburst or Immuta yet (such as a new table being created with `CREATE TABLE`).*

For example, the following configuration allows `READ`, `WRITE`, and `OWN` operations to be authorized on data sources registered in Immuta and all operations are permitted on data that is not registered in Immuta:

```bash
immuta.allowed.immuta.datasource.operations=READ,WRITE,OWN
immuta.allowed.non.immuta.datasource.operations=READ,WRITE,CREATE,OWN
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://documentation.immuta.com/saas/configuration/integrations/starburst-trino/how-to-guides/write-access-mapping.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.