Instructions
- Define Access Grant:
- Defined at the Model level. - Links a user_attribute to a set of allowed_values.
- Apply Access Grant:
- Use required_access_grants: [grant_name] at the Explore, Join, View, or Field level. - User must match all listed grants to see the object.
- Best Practices:
- Exact Match: allowed_values must match the user attribute value distinctively (no wildcards/partial matches). - Additive: Grants are additive. If a View requires Grant A and a Field requires Grant B, the user needs *both* to see the field.
Examples
Basic Access Grant
# In model file
access_grant: can_view_finance {
user_attribute: department
allowed_values: ["finance", "executive"]
}
# In view file
view: finance_data {
required_access_grants: [can_view_finance]
# ...
}Field-Level Security
dimension: salary {
type: number
sql: ${TABLE}.salary ;;
required_access_grants: [can_view_finance]
}