On the data permissions page of a dataset, you can control row-level and column-level permissions at the dataset level.

Key terms
User attributes: These are the attributes or tags of users within the project. User attribute information is an essential source of dynamic values for row-level data permissions.
Row permissions: By adding a "row permissions" rule to a dataset, you can restrict specified users to view only certain rows of data. For example, user A can only view data in the dataset where the "region" field equals Shanghai.
Column permissions: By adding a "column permissions" rule to a dataset, you can configure sensitive columns so that users outside the specified range cannot view the data in those columns. For example, user A can view the "income" column data in the dataset, while other users cannot.

2.1 Create data permission rules #

(1) Open the dataset details page where you need to set row or column permissions, click "Data Permissions" - "Add Data Permission", and enter the data permission editing page.

(2) The name of the data permission rule can be customized.

(3) Set specific rules for the dataset; you can choose row permissions or column permissions.

(4) Select the users, user groups, or role groups to whom the rule applies.
SaaS version:

Private deployment version: This capability allows the "members to whom the rule applies" to select "roles" within the project. Some roles do not support permission assignment by non-role administrators.

(5) Click the "Save Rule" button in the upper right corner. The configured data permissions will take effect immediately.

(6) To set multiple data permission rules, repeat the steps above.

2.2 Data permission rule operations #

2.2.1 View details #

Click the view details icon to see the content of the rule and the members to whom it applies.

2.2.2 Edit #

Go to the corresponding data permission editing page to modify the configuration.

2.2.3 Copy #

You can copy existing data permission rules. If multiple data permission rules have similar configurations, you can quickly configure them by copying existing rules.

2.2.4 Delete #

Supports deleting data permission rules that have already been configured.

3.1 Row permissions · Fixed value #

• Select the dataset field restricted by the row permission rule and set a fixed value. Grant users (or user groups) access to only the data where the dataset field equals the specified value.
• This is suitable for scenarios where there are few controlled users, or quick authorization can be achieved through simple user group operations.
• Supports configuring one or more restriction rules.

As shown in the figure, when members access charts generated from the dataset, they can only view data where Province = 'Shanghai' and cannot access all data.

3.2 Row permissions · Dynamic value #

• Select the dataset field restricted by the row permission rule and match user attributes. Dynamically grant users (or user groups) access to only the data where the dataset field value equals the user's attribute value.
• This is suitable for scenarios where there are many controlled user attribute values, making configuration with fixed values inconvenient, and authorization can be distinguished by specific attributes.
• Supports configuring one or more restriction rules.

User attribute configuration reference documentation: User Properties. As shown in the figure, when members access charts generated from the dataset, they can only view data where the user field matches their own name and cannot view other users' data.

3.3 Column permissions #

Set specific columns in the dataset as sensitive columns. Only users or user groups designated as viewable members, dataset administrators, and users with project-wide view permissions can access them. Other users cannot view sensitive field data. As shown in the figure, except for viewable members such as "Administrator", other users cannot view the sensitive column model field 'Job Submission Rate' when accessing charts or dashboards generated from the dataset. This column is hidden from members other than viewable members.

Except for the sensitive column 'Assignment Submission Rate', fields created based on 'Assignment Submission Rate', such as 'Submission Rate Target Achieved' and 'Average Submission Rate', will also be affected and will be hidden from users other than 'Administrators'.

To prevent associated fields from being affected, set individual dataset fields, rather than model fields, as sensitive columns.

3.4 When multiple row or column permission rules exist in a dataset #

When a dataset contains multiple row and column permission rules at the same time, affected users can view the union of the rule permissions they possess. For example, if both Rule 1 and Rule 2 in a dataset apply to User A, and Rule 1 allows User A to view data in Row A while Rule 2 allows User A to view data in Row B, then User A can view data in both Row A and Row B. When a dataset contains multiple row and column permission rules that apply to some users at the same time, the data range that users can view can be considered separately for rows and columns. For example, if Rule 1, Rule 2, and Rule 3 in a dataset all apply to User B, where Rule 1 is a row permission rule that allows User B to view data in Row A, and Rule 2 and Rule 3 are column permission rules, with Rule 2 allowing User B to view the sensitive column B, and Rule 3 preventing User B from viewing column C, then User B can view the data in Row A, excluding column C. As shown in the figure, User B is included in the affected users (groups) of Rule 1 and Rule 2, but not in the affected users (groups) of Rule 3:

The final data that User B can view is:

3.5 Scope of effectiveness for row and column permissions #

Caution: For users not mentioned in the configuration of row and column permission rules, the product provides a setting for the scope of effectiveness of row and column permissions, which is disabled by default. That is, users not matched by any row and column permission rules cannot view any data. Dataset administrators can switch this setting as needed.

Row permissions

• Users other than applicable members cannot view any row data.
• Members other than the applicable members are not subject to row permission control and can view all row data.

3.6 Column permissions #

• Applicable members can view this column, while users other than the applicable members cannot view it.
• Applicable members cannot view this column, while users other than the applicable members can view it.

3.7 Permission simulation verification #

After completing the data permission configuration, dataset administrators can simulate user identities to view what data the corresponding user can see in the dataset, thereby verifying data permissions and avoiding misconfigurations. Click "Permission Simulation Verification".

Enter the user to be verified, that is, the user whose data permission scope needs to be simulated, and click "Start Verification".

Then, you will enter the visualization interface of the dataset as the verified user. You can configure charts to check the data range that the user can view. You can switch between multiple users on the current page to perform permission simulation verification.

After verification, click "Exit Verification" to return to the data permission interface. If there is an issue with the current user's viewing scope during verification, you can check and adjust the data permission configuration. After confirming that the permission scopes for all user identities are correct, you can confidently proceed with publishing charts and dashboards.

3.8 Notes on row and column permissions #

Starting from version V2.54.0, if customers use DataLeap simultaneously, the row and column permissions of DataLeap will also take effect in DataWind. After DataWind connects to DataLeap's data, it will display which fields and which rows are not permitted. This capability also depends on the product base version. If it is a lower version of the base, additional deployment of DataLeap components is required. For details, please contact the customer success manager.

For details, see:Best Practices for Configuring Row and Column Permissions