Row security
Show each person only the rows that match them, on dashboards, published pages and Ask AI.
Row security filters a dataset by who is looking at it. A regional manager opens the same dashboard as everybody else and sees their own region; the totals, the charts and the answers Ask AI gives are all about their rows.
The rule lives on the dataset, not on the dashboard. Five dashboards reading one dataset are all covered by one rule, rather than carrying five rules that drift apart.
Setting a rule needs a paid plan. See Billing. A rule already in place keeps filtering if a team moves back to Free, and can still be switched off.
Before you start
You will need:
| A paid plan | Pro or above. On Free, everyone in the team sees every row. |
| The admin role on the team | Only an admin sets a rule or says who is who. A member who could rewrite it could show themselves anything. |
| A column that names the scope | Something like region, store, owner or account. The rule matches this column against a value you set for each person. |
Turn it on
Open Data, find the dataset, and choose Row security from its menu.
Switch it on
The switch at the top is the state of the dataset. Off means everyone in the team sees every row, which is where every dataset starts.
Pick the column and the attribute
Column in this data is the column in the dataset. Must match their names the thing you will set for each person: region, store, whatever fits.
The name is free text because the first rule in a team names something nobody has yet. Once one exists it is offered as a chip so the next rule matches it exactly, since region and Region are the same key here.
Check it before you save
See this data as takes a person and tells you how many rows they would get, with the first few of them. It checks the rule on screen, not the saved one, so a wrong rule is found here rather than by the person it emptied.
Save
The rule takes effect immediately, everywhere the dataset is used.
Say who is who
A rule filters against a value held per person. Open Settings → Team, where Set data access appears once a rule exists.
Tick the people, type the value once, save. Each row shows its current value or Not set, so you can see at a glance who is missing one.
Selecting a single person shows everything they carry, and clearing a field clears that attribute. Selecting several applies only what you typed and leaves the rest of what each of them holds alone.
Somebody who covers two regions
Separate values with a comma. A person whose region is APAC, EMEA matches rows in either.
A value containing a comma cannot be expressed, which is the trade for being able to type two values without being told how.
What each person sees
| Who | Sees |
|---|---|
| A team admin | Every row. Admins are exempt, so the person who wrote the rule can tell whether it is right. |
| A member or viewer with a value set | The rows matching their value or values. |
| A member or viewer with no value set | Nothing at all, from that dataset. |
That last row is deliberate: a rule that cannot identify somebody refuses rows rather than serving them. It is also why the member list marks who is missing a value, and why the dialog warns you when saving would leave somebody empty.
The filter runs before anything is calculated, not after. Totals, averages and Ask AI answers are all about that person's rows, so there is no way to reach the others by asking a different question.
Where it applies
Everywhere the dataset is read:
- Dashboards in the app
- Published dashboards on your own domain
- Ask AI, in the app and on a published dashboard
- Data exports
Dashboards it cannot cover
A rule needs to know who is looking. Two ways of publishing carry no identity, and a dashboard published either way serves nobody any rows once its dataset has a rule:
| Published as | Works with row security |
|---|---|
| Anyone with the link | No. There is no person to match. |
| Password protected | No. A shared password is not a person. |
| Anyone signed in | Yes |
| Named email addresses | Yes |
| The team | Yes |
Flitch refuses the combination when you publish, and names the affected dashboards in the rule dialog before you save. Power BI hits the same wall from the other side: Publish to web does not support row-level security either.
Turn it off
Open Row security on the dataset, switch it off, and save. Everyone in the team goes back to seeing every row, and the dashboard can be published publicly again.
Nothing is thrown away. The column and the attribute stay on the dataset, and the values you set for people stay too, so turning it back on is one switch rather than a rule retyped from memory.
What it does not do
- One rule per dataset. One column matched against one attribute. Two dimensions at once cannot be expressed.
- Rows, not columns. Everyone who can see a row sees all of it.
- Admins are never filtered. If somebody must be filtered, they should not be an admin.