The RLS editor: protection and modes

The RLS step of a table popup is where a table gets its row level security: the Protection switch, the Rules and SQL views, and the Auto and Manual editing modes. Use it when different permission groups should see different rows of the same table.

The step appears on Warehouse View, Dictionary, Static, Dimension and Fact tables and on Lake staging tables. This page covers the step's switches and modes; the rules themselves are covered in Build RLS access rules, and Row level security editor walks the whole step through. For what row level security does and who may change it, see Warehouse permissions and row-level security; on Lake, the step sits in the popup described in Configure a table.

Turn protection on or off

The Protection group holds the switch that turns row level security on for the table. Its hint reads Row Level Security and "When On, each permission group only sees rows matching its rules. When Off, every group can access all rows."

• The switch applies straight away, not with the popup's step save, and it is blocked while the change is being applied.
• While Protection is Off, no rules are applied: every permission group can access all rows of the table.
• While it is On, each permission group sees only the rows that its rules allow; the rules are built in the Rules view.

Read the rules or the script

The step shows one of two views: Rules holds the rule blocks that filter rows per permission group, and SQL shows the script they produce.

• A new rule block starts as an AND group with no conditions; you add its conditions and groups yourself.
• SQL shows the script your rules produce, and it becomes editable once the editor is in Manual.

Choose the editing mode

The Editor group decides how the script is written. Its hint reads Editing mode and "Auto keeps SQL in sync with your rules. Manual lets you write SQL by hand - switching back to Auto discards manual edits."

• Auto keeps the script in step with your rules: change a rule and the SQL follows.
• Picking Manual copies the generated script into the manual script, so you start from what your rules produced.
• Switching back to Auto discards your manual edits and the script follows your rules again.
• The step moves to the SQL view when manual editing starts, and it returns to Rules when manual editing ends.

When the rules area stops taking edits

The rules area and New Query need Protection On, the Editor in Auto and no RLS change being applied.

• While Protection is Off or the editor is Manual, the rules area is dimmed and does not react to clicks, and New Query is unavailable.
• The same applies while an RLS change is being applied: wait for it to finish, then edit again.
• The Security Labels system column stays out of RLS: it never appears as a rule field or in the SQL editor's suggestions.

Leave the expanded editor safely

The editor expands into its own window over the popup. Closing it while it holds unsaved changes asks first: Discard unsaved changes?, with "You have unsaved RLS changes. Close without saving?" and a warning-styled Discard button.

• Discard closes the expanded editor and drops those changes; the step keeps its last saved state.
• To keep your changes, save before you close. The step saves with the popup's own save controls, like the popup's other steps, and nothing reaches the table before that.

Questions, answered

Which tables can I set up row level security on?

Warehouse View, Dictionary, Static, Dimension and Fact tables, and Lake staging tables. The step appears in each table's popup; on Lake, it sits in the popup described in Configure a table.

Does the Protection switch save on its own?

Yes. It applies straight away, not with the popup's step save, and it is blocked while the change is being applied. Wait for it to finish before changing it again.

What is the difference between the Protection switch and the Editor mode?

Protection decides whether row level security applies at all: Off lets every group access all rows. The Editor decides only how the script is written: Auto keeps it in step with your rules, and Manual lets you write the SQL by hand.

Why did the step switch to the SQL view?

Manual editing started. The step moves to the SQL view when you edit the script by hand, and it returns to Rules when manual editing ends.

What happens to my script when I switch to Manual and back to Auto?

Picking Manual copies the generated script into the manual script, so you begin from what your rules produced. Switching back to Auto discards your manual edits, and the script follows your rules again.

Why is the rules area dimmed?

Because it cannot take edits right now: the rules area and New Query need Protection On, the editor in Auto and no RLS change being applied. Fix the setting or wait for the change to finish, and it accepts clicks again.

What does a new rule block start with?

An AND group with no conditions. See Build RLS access rules for adding its conditions and groups.

What happens to my changes if I close the expanded editor?

If the editor holds unsaved changes, closing it asks first: Discard unsaved changes?, with "You have unsaved RLS changes. Close without saving?". Discard closes it and drops those changes; the step keeps its last saved state. Save before you close if you need them.