Row level security gives each permission group of a Lake or Warehouse table its own row filter, built from conditions on the table's columns. This page covers what goes into a condition: the fields you can pick, the operators each column type offers, and the value input that appears. For the protection toggle, the Rules and SQL views and saving, see Row level security editor; for where the RLS step sits and who can change it, see Warehouse permissions and row-level security.
Source Id, Source System Id and Delete Flag.For example, a condition can read: field Region, operator =, value EMEA.
A rule block pairs its conditions with the permission groups it filters: choose the permission groups for the block, then add the conditions. Conditions combine with AND or OR, and NOT negates a group.
The editor sorts each column into one of the groups below. Nullable(. wrappers and type parameters are ignored, so Nullable(Decimal(38, 18)) behaves like a decimal column and DateTime64(3) like a timestamp.
| Column type | Operators offered |
|---|---|
integer, bigint, float, decimal | =, !=, >, <, >=, <=, in, not in, between, not between, is null, is not null |
text, varchar | =, !=, in, not in, between, not between, is null, is not null, starts with, does not start with, ends with, does not end with, contains, does not contain |
date, timestamp | =, !=, >, <, >=, <=, in, not in, between, not between, is null, is not null |
boolean | =, !=, is null, is not null |
| Composite or unknown types (arrays, tuples, maps, UUID, enums) | The text operators |
The value input follows the field and the operator:
| Condition | What appears |
|---|---|
is null, is not null | Nothing to fill in. |
in, not in | A tag input, typed to the column: text, number, date, decimal or boolean values. |
in, not in on Source System Id | A picker of the column's values instead of the tag input; choose up to 10 at once, with the hint Select Partitions. The picked values are kept as one comma-separated list. |
=, != on Source System Id | A picker of the column's values. |
between, not between on date or timestamp | Two boxes, prefixed From and To. |
=, != on boolean | A picker with True and False. |
| Everything else | A single text box. |
Small hints in the boxes tell you what to enter: number and decimal for single values, number and number and decimal and decimal for between and not between on those types, text, prefix and suffix for text conditions, YYYY-MM-DD and YYYY-MM-DD HH for dates and timestamps, and True or False for booleans. A numeric column whose name looks like an ID, such as User Id or userId, shows id as its hint instead of number.
Security Labels cannot be a rule field. That column drives row level security itself.admin permission group is hidden when you choose the permission groups for a rule block, and the generated script leaves it out of the roles too.Conditions become part of a SQL script, and the script reads each column by its stored name. That is why the field list shows names such as customer_id and not a display label.
The Security Labels column drives row level security itself, so it is never offered as a rule field.
The admin group is hidden from that picker, and the generated script leaves it out of the roles as well.
Operators follow the column's type, as the table above shows. Text columns add the pattern operators (starts with, does not start with, ends with, does not end with, contains, does not contain) that number and date columns do not have; boolean columns get only =, != and the null checks.
is null and is not null ask whether the column has a value at all, so there is nothing to fill in.
The box hints read YYYY-MM-DD for dates and YYYY-MM-DD HH for timestamps. With between and not between, two boxes appear, prefixed From and To.
For most columns, in and not in use a tag input you fill with values. On Source System Id, the picker holds up to 10 values.
A numeric column whose name looks like an ID, such as User Id or userId, shows id instead of number as its hint. It is only a hint for what to type.
Yes, through the text operators. The editor cannot compare those types as numbers or dates, so it offers =, contains and the other text conditions instead.