Row level security rules and operators

Row level security gives each permission group of a Lake or Warehouse table its own row filter, built from conditions on the table's columns. This page covers the rule builder: rule blocks and the permission groups they target, how conditions combine, the fields you can pick, the operators each column type offers, and the value input that appears. For the protection toggle, the Rules and SQL views and saving, see Row level security editor; for where the RLS step sits and who can change it, see Warehouse permissions and row-level security.

Add a rule block

1. In the table's RLS step, set Protection to On and the Editor to Auto.
2. Click New Query. Its tooltip reads "Add a rule block - each targets permission groups with its own row filter conditions."
3. In the block's Groups field, choose the permission groups the block filters. Its placeholders read Add groups… and Search groups….
4. Build the block's conditions, as the next section describes.

• Each block carries a number badge showing its place in the list, counting from 1, plus its permission groups and its own conditions.
• A block has one set of conditions and applies them to every permission group you pick in it. Groups you do not pick in the block are not filtered by it.
• A block holds up to 20 permission groups; for more, add another block.
• The X in a block's header removes the whole block. It is labelled Remove access rule.
• Until you add a block, the panel reads No access rules yet with "Add a rule to control which rows each permission group is allowed to see." and the New Query button.
• New Query is unavailable while the editor is Manual or protection is Off. With no block yet, a Manual editor shows Visual rules unavailable with "Adding access rules is available only in Auto mode while you are editing SQL manually.", plus two hints: "Switch the editor to Auto to build rules visually." and "Open the SQL view to edit your script manually." See Row level security editor.

Build a condition

1. In the rule block, use its condition line, or add another with the Rule chip.
2. Pick a field. The list holds the table's columns, shown by their stored names, plus the system columns Source Id, Source System Id and Delete Flag.
3. Pick an operator. The list follows the column's type, so a text column offers text operators and a number column offers number operators.
4. Enter the value. The input changes with the field and the operator, as the next sections describe.

For example, a condition can read: field Region, operator =, value EMEA.

Combine conditions

Conditions sit inside a group. Combine the conditions of a group with its AND / OR control, and use the NOT toggle to negate the group, so the filter matches the rows that do not fit its conditions. The NOT toggle turns red while it is on. The bar that holds these controls is labelled Logic operators.

• The Rule chip adds another condition line.
• The Group chip adds a nested group with its own AND / OR and NOT controls.
• A condition's X is labelled Delete rule. A nested group's X is labelled Delete group.

Operators by column type

The editor sorts each column into one of the groups below. Nullable(...) wrappers and type parameters are ignored, so Nullable(Decimal(38, 18)) behaves like a decimal column and DateTime64(3) like a timestamp.

Which value input appears

The value input follows the field and the operator:

Small hints in the boxes tell you what to enter: number and decimal for single values, number and number and decimal and decimal for between and not between on those types, text, prefix and suffix for text conditions, YYYY-MM-DD and YYYY-MM-DD HH for dates and timestamps, and True or False for booleans. A numeric column whose name looks like an ID, such as User Id or userId, shows id as its hint instead of number.

What the editor leaves out

• Security Labels cannot be a rule field. That column drives row level security itself.
• The admin permission group is hidden when you choose the permission groups for a rule block, and the generated script leaves it out of the roles too.

Questions, answered

Why do the rule fields show technical column names?

Conditions become part of a SQL script, and the script reads each column by its stored name. That is why the field list shows names such as customer_id and not a display label.

Why can't I pick Security Labels as a rule field?

The Security Labels column drives row level security itself, so it is never offered as a rule field.

Why don't I see the admin group when I choose groups for a rule?

The admin group is hidden from that picker, and the generated script leaves it out of the roles as well.

Why does a text column offer more operators than a number column?

Operators follow the column's type, as the table above shows. Text columns add the pattern operators (starts with, does not start with, ends with, does not end with, contains, does not contain) that number and date columns do not have; boolean columns get only =, != and the null checks.

Why is there no value box next to is null?

is null and is not null ask whether the column has a value at all, so there is nothing to fill in.

What formats do dates and timestamps use?

The box hints read YYYY-MM-DD for dates and YYYY-MM-DD HH for timestamps. With between and not between, two boxes appear, prefixed From and To.

How many values can I pick at once?

For most columns, in and not in use a tag input you fill with values. On Source System Id, the picker holds up to 10 values.

What does the id hint mean?

A numeric column whose name looks like an ID, such as User Id or userId, shows id instead of number as its hint. It is only a hint for what to type.

What is the difference between the Rule and Group chips?

Rule adds a single condition line. Group adds a nested group that holds its own conditions with their own AND, OR and NOT controls.

Do the groups in one block share the same filter?

Yes. A block has one set of conditions, and it applies them to every permission group you pick in it. Groups you do not pick in the block are not filtered by it.

How do I remove a condition, a nested group or a whole rule block?

Use the X next to it. A condition's X is labelled Delete rule, a nested group's X is labelled Delete group, and the X in a block's header is labelled Remove access rule and removes the whole block.

Can I use an array or UUID column in a rule?

Yes, through the text operators. The editor cannot compare those types as numbers or dates, so it offers =, contains and the other text conditions instead.