1.1 Applicable scenarios #

(1) Scenario 1:
Team personnel changes frequently. For example, each business staff member's assigned business line often changes. If each business staff member is restricted to viewing only the data for their respective business line, then the applicable members for row and column permissions must be frequently updated during normal configuration. If there are many resources or personnel, the configuration can become very cumbersome.
(2) Scenario 2:
There are some region fields in the dataset. It is now expected that the business staff responsible for a region can automatically obtain permissions based on the value of the region field in the dataset, eliminating the need to manually configure or modify permissions.

1.2 Configuration process #

(1) For example, our dataset contains a province field. Each Sales representative is responsible for a different province and can only view data for their assigned province.

(2) In this case, the dynamic configuration feature for row and column permissions can be used. First, add a province attribute in the user properties of the project center, then set the province attribute value for each corresponding Sales representative to the province they are responsible for.

(3) Next, on the row and column permissions configuration page, select Sync from dataset, then select the "sale_province" field equal to the "province" attribute. In this way, the applicable members for this row and column permission will automatically obtain dataset row and column permissions based on their own attribute values.

(4) Dynamic values also support configuring attributes for user groups. After adding row and column permissions to the entire user group, business staff within the user group can directly obtain the corresponding permissions. User attributes also support batch configuration through Open APIs for Users, User Groups, and Permissions.

2.1 Basic concepts #

2.1.1 Row permissions #

By adding dataset 'row-level permission' rules, users within a specified scope can only view row data within that scope. Row-level permissions apply to datasets and control the data range that users can see when viewing charts or dashboards created from these datasets.
Therefore, when charts on a dashboard come from different datasets, it is sometimes necessary to configure multiple sets of row-level permissions for each dataset to control the data range that users can see across the entire dashboard.

2.1.2 Dashboards and datasets #

The relationship between dashboards and datasets can be one-to-one or one-to-many. Datasets can be used to create charts, and charts can be saved to dashboards; dashboards can display multiple charts from different datasets within the same project.

2.2 Expected outcome #

This configuration applies to the following scenarios:
Scenarios where dashboard data needs to be personalized for each user. For example, with a performance dashboard, only one performance dashboard is configured. Different users see their own performance data when viewing the dashboard, while managers can see the data for the personnel they are responsible for.
Taking the course performance dashboard as an example, dashboard viewers are divided by permission into: managers, regional leaders, and frontline tutors. The data accessible to these three types of users is as follows:

2.3 Steps #

2.3.1 Clarify requirements #

Before configuration, review the permissions to be configured, including which datasets are used by the dashboard, user types, and the data matching rules for each type of user.

• Dashboard: Specify which charts on which dashboard require row-level permissions, and clarify the configuration scope.
• Dataset: Identify which datasets correspond to the charts to be configured.
• User roles: Determine the basic configuration rules, specify which types of users require row-level permission configuration, and note that the rules differ between user types.
• Key attributes and corresponding dataset fields: The matching items for each user role's configuration rules.

Taking the performance dashboard as an example, suppose the performance dashboard is created from a single dataset. The permission rules are organized as follows:
In the performance dashboard, the charts correspond to the performance dataset, and permissions need to be granted to administrators, regional leaders, and frontline coaches. Among these, administrators are granted all permissions, regional leaders are granted permissions for the bases they are responsible for, and frontline coaches are granted their own performance permissions based on their email prefix (username).

• If the dashboard corresponds to multiple datasets, this means that row-level permissions may need to be configured for multiple datasets. Rules need to be organized and configured for each dataset individually.
• Key attribute: which user attribute should be used to match permissions. After determining the attribute and field, the row-level permission rule is that the user's key attribute equals the corresponding dataset field. In other words, only when the value of the corresponding field in the dataset is equal to the user's key attribute value can the user view the corresponding data.

2.3.2 User group and user attribute configuration #

When configuring user groups, it is recommended to create user groups based on roles to facilitate batch selection when configuring row-level permissions later. If user groups are not created based on roles, usernames can also be entered manually one by one when configuring row-level permission rules.

Note: Only project administrators can create and modify user groups.

In Project Center - User Management - User Groups, click + to add a user group.

You can use User Group Management --> "Add User Group" to batch add all users of a department to a user group, or use User Management --> "Add User" to add a single user.

Tip: When adding a single user, you can paste multiple user email prefixes separated by commas to add them in bulk.
For example: zhangsan,lisi,wangwu. Copy this segment into the add user input box to batch add Zhang San, Li Si, and Wang Wu.

Configure user attributes in Project Center - User Attributes. User attributes refer to information about users in a project, which by default includes username, name, email, and department. By configuring user attributes, you can add attributes for users and match permissions based on these attributes.
If there are no attributes in the project, click "Attribute Management" to manage and add attributes.

Click "Batch Update Attributes" to assign corresponding attribute values to users in bulk.

• For frontline tutors, since the system already has the username by default (that is, the email prefix), there is no need to update the attributes.
• For regional leaders, update the value of the "Responsible Base" attribute to the base they are responsible for; the format must be consistent with the format in the dataset. If the base field in the dataset is something like "Beijing", the attribute value must also be "Beijing" and not "Beijing City".
• For administrators, since they need to view all permissions, it is recommended to create a dedicated attribute "Enable All Row-Level Permission Data" and update the value of this attribute for administrators to [*].

2.3.3 Row-level permission rule configuration #

Go to the performance dataset—Row and Column Permissions to create row-level permission rules. In this case, you need to create three row-level permission rules for the performance dataset, with the configurations shown in the following figures:

Tutor: Use dynamic value matching. As shown in the figure below, when the value of the Tutor field in the performance dataset is equal to the value of the Username attribute of the user in the Tutor user group, the tutor can view the corresponding data.

Regional leader: Use dynamic value matching. As shown in the figure below, when the value of the Base field in the performance dataset is equal to the value of the Responsible Base attribute of the user in the Leader user group, the leader can view the corresponding data.

Administrator: Use dynamic value matching. As shown in the figure below, when the value of the Base field in the performance dataset is any value, the administrator can view the corresponding data, that is, all data.

Configure and save in sequence. On the data permission rules page of the dataset, you can see that there are three corresponding row-level permission rules under this dataset. If you are unsure whether the rules are effective, you can use the 3.7 Permission simulation verification feature to confirm.

2.3.4 Enable dashboard permissions #

After configuring row-level permissions, you also need to grant dashboard permissions to the corresponding users. In the upper right corner of the dashboard, click Authorize, search for the user group, and directly grant permissions to the user group.