> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/sdgm/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/sdgm/_mcp/server.

# How do authentication and data access work?

> Distinguish Python connector credentials from Helm sign-in and access controls

## Python Library

Kumo Engine runs in your Python environment without a separate Kumo workspace login. Each connector uses credentials such as a cloud workload identity, notebook identity, or database account.

Restrict data access through that identity's source-system permissions. A shared service identity uses its own grants; it does not automatically inherit the human user's permissions. See Connect Your Data using [Linux](/kumo-engine/user-code-guide/connect-your-data-linux), [Snowflake](/kumo-engine/user-code-guide/connect-your-data-snowflake), or [Databricks](/kumo-engine/user-code-guide/connect-your-data-databricks) for authentication by source.

## Helm Deployment

The prerelease Kumo Studio Helm deployment supports OIDC single sign-on or email and password authentication. Kumo group, project, and connector-identity permissions control access within the deployment.

Source-system access still depends on the connector's credentials. Scope those credentials separately from Kumo sign-in permissions.

See [Configure Single Sign-On](/kumo-engine/kumo-studio-guide-coming-soon/preliminary-documentation/deployment-architecture/configuring-sso) for OIDC setup. The group claim identifies group membership; permission mapping is configured separately in the admin UI or API.