Build RLS access rules

The RLS step of a table popup gives each permission group its own row filter. Its rule builder is where you add rule blocks, choose the permission groups each block targets, and build the conditions that filter the rows those groups see. The step appears on Warehouse Dimension, Fact, Dictionary, Static and View tables and on Lake staging tables.

For the protection switch, the Rules and SQL views, the Auto and Manual editor modes and saving, see The RLS editor: protection and modes. For what row level security does and who may change it, see Warehouse permissions and row-level security.

Add a rule block

1. In the table's RLS step, set Protection to On and the Editor to Auto.
2. Click New Query. Its tooltip reads "Add a rule block - each targets permission groups with its own row filter conditions."
3. In the block's Groups field, choose the permission groups the block filters. Its placeholders read Add groups… and Search groups….
4. Build the block's conditions, as the next section describes.

• Each block carries a number badge, its permission groups and its own conditions.
• A block holds up to 20 permission groups.
• The admin group is hidden: it is not offered in the picker, and the saved rule leaves it out.
• The X in a block's header removes the whole block. It is labelled Remove access rule.
• Until you add a block, the panel reads No access rules yet with "Add a rule to control which rows each permission group is allowed to see." and the New Query button.
• New Query is unavailable while the editor is Manual or protection is Off.

Build conditions

Each condition is one field, one operator and one value. Conditions sit inside a group.

1. Pick the column in the field selector.

2. Pick the operator from the operator list.

3. Fill the value box. It changes with the field and the operator:

   • a plain text box for most values;
   • a True / False picker for a true or false condition;
   • a date picker on a 24-hour clock for a single date;
   • two boxes, prefixed From and To, for between and not between on a date or timestamp.

The complete mapping of column types, operators and value boxes is in Row level security rules and operators.

Combine the conditions inside a group with its AND / OR control, and use the NOT toggle to negate the group. The NOT toggle turns red while it is on. The bar that holds these controls is labelled Logic operators.

• The Rule chip adds another condition line.
• The Group chip adds a nested group with its own AND / OR and NOT controls.
• A condition's X is labelled Delete rule. A nested group's X is labelled Delete group.

When rules cannot be edited

While the editor is in Manual, the rules area stops accepting edits. With no block yet, it reads Visual rules unavailable with "Adding access rules is available only in Auto mode while you are editing SQL manually.", plus two hints: "Switch the editor to Auto to build rules visually." and "Open the SQL view to edit your script manually."

Set the Editor back to Auto to build rules again.

How rules and SQL stay in step

In Auto, the generated SQL follows your rules as you edit them. Setting the Editor to Manual copies the generated SQL into the script for editing by hand, and switching back to Auto discards those manual edits. The views, the modes and the discard dialog are described in The RLS editor: protection and modes.

Questions, answered

How many permission groups can one rule block target?

Up to 20. If you need more, add another block.

What does the number on a rule block mean?

It shows the block's place in the list, counting from 1.

How do I remove a condition, a nested group or a whole rule block?

Use the X next to it. A condition's X is labelled Delete rule, a nested group's X is labelled Delete group, and the X in a block's header is labelled Remove access rule and removes the whole block.

What does the red NOT toggle do?

It negates the group it sits in, so the filter matches the rows that do not fit its conditions.

What is the difference between the Rule and Group chips?

Rule adds a single condition line. Group adds a nested group that holds its own conditions with their own AND, OR and NOT controls.

Why do I see "Visual rules unavailable"?

The editor is in Manual mode and there are no blocks yet, so there is nothing to edit visually. Switch the editor to Auto to build rules, or open the SQL view to edit your script manually.

Which conditions show the From and To boxes?

Conditions with the between and not between operators on a date or timestamp. Each side gets a box, prefixed From and To.

Do the groups in one block share the same filter?

Yes. A block has one set of conditions, and it applies them to every permission group you pick in it. Groups you do not pick in the block are not filtered by it.