Important: Hue and the underlying cluster services have completely separate permissions!
Users who log on to the Hue UI must have permission to use Hue, and also, each CDH service accessible within Hue.
Once Hue is authenticated by a service (for example, Hive), Hue impersonates the user (doAs) requesting use of that service (for example, to create a table). The service uses Sentry (essentially a chmod tool) to ensure the group to which that user belongs is authorized for that action.
Hue user permissions are at the application level only. For example, a Hue superuser can filter Hue user access to a CDH service but cannot authorize the use of its features. Again, Sentry does that. Learn how to Authorize Hue User Groups with Sentry.
Ref Doc: https://docs.cloudera.com/documentation/enterprise/6/6.3/topics/hue_adm_permissions.html