Row level security editor

The RLS step of a table popup is where a Lake or Warehouse table gets its row level security: rules that decide which rows each permission group sees. It appears on Warehouse Dimension, Fact, Dictionary, Static and View tables and on Lake staging tables. Use it when different people should see different rows of the same table. For what goes inside a rule, see Row level security rules and operators; for what row level security does and who may change it, see Warehouse permissions and row-level security and Who can do what in the Lake.

The step opens with protection Off, the editor in Auto and no rule blocks. If the table has no permission group yet, it shows Permission Groups Required with a Go to General button; add a permission group on General first.

The three toolbar groups

The step's toolbar groups its controls under three labels:

Turn protection on or off

1. In the Protection group, click On.
2. The switch applies straight away, not with the step's save. A spinner replaces the shield while the change is being applied, and both segments are disabled until it finishes.
3. A toast confirms it: RLS enabled successfully or RLS disabled successfully. If the change fails, the switch returns to its previous position and an Error toast reads Failed to toggle RLS.

While protection is Off, the step shows only the switch and the message "RLS is off - all permission groups can read every row. Turn protection on to start defining access rules."

Add rule blocks

With protection On, New Query adds a rule block. Its tooltip reads "Add a rule block - each targets permission groups with its own row filter conditions."

• Until a block exists, the panel shows No access rules yet ("Add a rule to control which rows each permission group is allowed to see.") with a New Query button.
• Each block carries a number, the permission groups it applies to and its own conditions. Groups are chosen in a chips input (placeholders Add groups… and Search groups…); the hidden admin group is not offered, and a block can hold up to 20 groups.
• New Query is unavailable while the editor is Manual, while protection is Off, and while the protection change is being applied.
• The X in a block's header removes it; it is labelled Remove access rule.

Preview or edit the SQL

The View group switches between Rules and SQL.

• Rules shows the blocks; once at least one block exists, the segment carries a count badge.
• SQL shows the script. A chip next to the pane reads Preview while the script is generated for you, and Editable when you can type into it. The pane is read-only unless protection is On and the editor is Manual.
• The script you see in Auto is generated from your rules, and viewing it saves nothing.
• Until at least one condition exists, there is nothing to generate and the pane is empty.

Write the SQL by hand

Set the Editor group to Manual to type the script yourself.

• Selecting Manual loads the last generated script as your starting point.
• If the table already has rule blocks, the switch asks first: "Are you sure you want to proceed with this change? This may affect your data integrity."
• Switching back to Auto discards your manual script. When the script differs from the generated result, the switch asks first: "Are you sure you want to proceed with this change? Your manual script will be lost."
• In Manual the Rules view stops accepting edits: blocks appear dimmed, and with no blocks the view reads Visual rules unavailable ("Adding access rules is available only in Auto mode while you are editing SQL manually.").

Work in the expanded view

Expand opens Row Level Security as a two-pane workspace: Access Rules on the left and SQL Preview on the right. The subtitle reads "Build access rules on the left and preview generated SQL on the right. Save when done."

• The header shows the number of rule blocks and an Unsaved badge while your edits differ from what the step holds.
• Save copies your edits back to the step, where Revert and Apply then appear; it stays disabled until you change something.
• Close, or dismissing the workspace, with unsaved edits asks Discard unsaved changes? ("You have unsaved RLS changes. Close without saving?"). Discard closes it and drops the draft.
• The workspace carries its own Protection and Editor controls and its own New Query; the changes you make there stay in the draft until you click Save.
• While it is open, the step itself shows Opened in expanded view with a Return here button, which leaves the workspace with the same discard check.

Save the step

• Revert and Apply appear in the popup footer once the step has unsaved changes. Apply saves the step; Revert returns it to its last saved state.
• Saving replaces the table's whole rule set in one go: every block with its permission groups, and the script. There is no separate save for a single block.
• The toast names the save: on a table you are still creating it reads RLS settings saved successfully., on an existing table it reads RLS settings updated successfully., and in the Lake staging popup it reads RLS saved successfully. A failure shows an Error toast reading Failed to save RLS settings.

Questions, answered

Why can't I click On or Off right now?

The switch is still applying its last change: a spinner replaces the shield, and both segments are disabled until it finishes.

What happens if switching protection fails?

The switch returns to its previous position and an Error toast reads Failed to toggle RLS. Nothing changed; try again.

What does the number next to Rules mean?

It counts the rule blocks you have added. It appears only while at least one block exists.

What do the Preview and Editable labels mean?

Preview marks a script generated for you that you cannot type into. Editable appears when you can edit it: protection is On and the editor is Manual.

Why can't I add a rule block?

New Query is unavailable while the editor is Manual, while protection is Off, and while the protection change is being applied.

Why is the SQL view empty?

The SQL view shows a script generated from your rules, so until at least one condition exists there is nothing to generate. In Manual it shows your own script instead.

Where does Manual mode get its starting script?

From the last generated script. Selecting Manual loads it into the editor, and you edit from there.

Why did I have to confirm switching to Manual?

Because the table already has rule blocks. The dialog reads "Are you sure you want to proceed with this change? This may affect your data integrity." Confirm it to switch, or dismiss it to stay in Auto.

When is my rule set saved?

When you save the step with Apply. The Save in the expanded view only copies your edits back to the step; nothing reaches the table until Apply. Saving replaces the whole rule set at once.

What happens if I close the expanded view without saving?

The workspace asks first: Discard unsaved changes? ("You have unsaved RLS changes. Close without saving?"). Discard closes it and drops the draft; the step keeps its last saved state.

Why can't I expand the step?

While protection is Off, the step shows only the protection switch and the off message, so the toolbar actions, including Expand, are not there. Turn protection On.