> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/saas/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/saas/configuration/integrations/starburst-trino/trino-connection-reference-guide/protecting-data.md).
# Protecting Data in Trino
In the Trino integration, the Trino Immuta plugin enforces policies on data registered in Immuta at query time. The sequence diagram below outlines the events that occur when an Immuta user who is subscribed to a data source queries it in Trino.
## Registering a connection
Trino is configured and data is registered through [connections](/saas/configuration/integrations/data-and-integrations/registering-a-connection/reference-guides/connections-overview.md), an Immuta feature that allows administrators to register data objects in a technology through a single connection to make data registration more scalable for your organization.
Once the Trino connection is registered, you can author subscription and data policies in Immuta to enforce access controls.
See the [Trino integration reference guide](/saas/configuration/integrations/starburst-trino/trino-connection-reference-guide.md#registering-a-connection) for more details about registering a connection.
## Protecting data
After data objects are registered in Immuta, you can author data and subscription policies in Immuta to enforce access controls.
### Subscription policies
When a subscription policy is applied to a data source, users who meet the conditions of the policy will be automatically subscribed to the data source. Then, the Trino Immuta plugin will allow the user to query that object.
Consider the following example that illustrates how Immuta enforces a subscription policy that only allows users in the `analysts` group to access the `yellow-table`. When this policy is authored and applied to the data source, Trino checks with the Immuta Trino plugin in charge of access control to see if the user should see the table, and the Immuta Trino plugin reaches out to the Immuta API to confirm table access. Once access is confirmed, [Trino grants the `SELECT` privilege](#user-content-fn-1)[^1] on `yellow-table` to users (registered in Immuta) that are part of the `analysts` group.
In the image above, the user in the `analysts` group accesses `yellow-table`, while the user who is a part of the `research` group is denied access.
See the [Author a subscription policy page](/saas/govern/secure-your-data/authoring-policies-in-secure/section-contents/how-to-guides/subscription-policy-tutorial.md) for guidance on applying a subscription policy to a data source. See the [Subscription policy access types page](/saas/govern/secure-your-data/authoring-policies-in-secure/section-contents/reference-guides/subscription-access-types.md#granting-starburst-trino-privileges) for details about the subscription policy types supported and Trino privileges Immuta grants on objects registered as Immuta data sources.
### Data policies
When a data policy is applied to a data source and a user subscribed to that data source queries it, the Immuta Trino plugin requests the policy definitions from the Immuta API. The Immuta API returns a SQL view expression to the Trino execution engine, which then constructs and executes the SQL statement on the backing catalogs and retrieves the data with appropriate policy enforcement.
In the example below, Immuta sends Trino a SQL view expression that represents the data policy that masks all columns tagged `PII`. Then, when the user in the `analysts` group queries `yellow-table`, which has the `PII` tag applied to the `email` column, the Trino execution engine executes that SQL statement and returns the result with the `email` column masked for that user.
See the [Data policies page](/saas/govern/secure-your-data/authoring-policies-in-secure/data-policies/reference-guides/data-policies.md) for guidance on authoring data policies in Immuta and the [supported data policies](/saas/govern/secure-your-data/authoring-policies-in-secure/data-policies/reference-guides/data-policies.md#data-policy-support-matrix) for the Trino integration.
[^1]: The specific privileges granted to the user vary depending on whether the subscription policy grants READ or WRITE access to the data source. See the [Subscription policy access types page](/saas/govern/secure-your-data/authoring-policies-in-secure/section-contents/reference-guides/subscription-access-types.md#granting-starburst-trino-privileges) for details.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://documentation.immuta.com/saas/configuration/integrations/starburst-trino/trino-connection-reference-guide/protecting-data.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.