Row Level Security

Control which rows of data each user can see in a source with row-level security rules and user variables.

Row level security (RLS) controls which rows of data a user can see in a source. You define a rule on a table and a user variable for each user; a user only sees rows where their variable matches the column named in the rule.

To use RLS with a Direct Connector, refer to that connector’s documentation.

RLS rules apply per user, through user variables — they can’t be assigned to Groups.

To set up RLS, open the Access Settings for your organization. Applying a rule to a source takes two parts:

• A rule — specifies which tables are affected, which column determines access, and which user variable is compared against that column.
• User variables — a value set for each user, matched against the rule’s column.

A rule applies to everyone or to no one by default. When it applies to no one, you grant access to specific users yourself.

User variables can take up to 5 minutes to apply. During this time, users can’t access any rows in tables with RLS rules.

To check a rule before you rely on it, use the Access Preview tool: select a table and a user to see how many rows that user can access.

Example

A leads table has a sales_rep_id column holding the id of each sales rep. You want every rep to see only their own leads.

lead_name	deal_stage	sales_rep_id	sales_rep
ACME	Prospect	1	John Doe
Contoso	Prospect	2	Jane Smith
Fabrikam	Proposal	2	Jane Smith

Create a rule

• Column: sales_rep_id
• Operator: =
• User variable: rep_id (any name works)
• Apply to tables: leads

The IN and NOT IN operators only support string user variables at this time.

Create user variables

1. For John Doe:
   • Variable: rep_id (must match the column above)
   • Value: 1
   • Users: select [e-mail] from the dropdown
2. For Jane Smith:
   • Variable: rep_id
   • Value: 2
   • Users: select [e-mail] from the dropdown

Now John Doe sees only the rows where sales_rep_id is 1, and Jane Smith only the rows where it is 2.

JSON format

User variables are stored as JSON, and the value type must match the column type in your database.

String value — for = operators:

"123"

Numeric value — for operators like >:

123

Numeric array — for IN operators:

[1, 23, 30]

String array — for IN operators:

["abc", "true", "22"]

Here both true and 22 are stored as strings, not as a boolean or a number.

Boolean value:

true

Numeric values are stored as the UInt64 type.

Access Preview

Select a table and a user — for example leads and [e-mail] — to see their access:

• 33.3% accessible
• Total rows: 3
• User can access: 1
• [e-mail] is bound by an access rule

Pair with page level access control

Row level security decides which rows a user sees when they query; Page Level Access Control decides which pages they can open. For customer-facing reports where each customer should see only their own data, use them together: per-page access in access.yaml, RLS rules on the underlying tables.