WHERE filter expressions by authorized principals (users or user groups), and limit the range of rows visible to different principals in the same table. After configuration, query requests for controlled tables automatically have the corresponding filter conditions appended in all authentication scenarios such as SQL, Notebook, and dashboards, and only rows that meet the conditions are returned.region = 'south', operations personnel in North China to see only orders where region = 'north', and the operations director to see all rows. This can be achieved by adding row filter expressions for different user groups.Limit | Description |
Applicable Scope | Row-level permission rules are configured per table and apply to that table. |
Authorized principal type | Supports users and user groups; when the same principal appears at both the user level and the user group level, the permission scope is the union of both. |
Expression format | A row filtering expression is a standard SQL WHERE clause fragment, for example, year > 2010 AND country != 'US'. |
Expression length | The maximum length of a single row filtering expression is 2,000 characters. |
Number of rules. | There is no hard limit on the number of row-level permission rules that can be configured for a single table. |
Validation item | Expressions support one-click validation, including basic checks such as whether fields exist, logic, and syntax; if validation fails, corrections are required before saving. |
Schema change behavior | After a field referenced by a row filtering expression is renamed or deleted from the table Schema, the related row-level permission rules automatically become invalid; you must edit the expression again to restore row-level permission control. |
User group member change | After user group members are added or removed, queries that are already in progress do not switch their visible row set in real time; the change takes effect for subsequently issued queries. |
Permission inheritance | The visibility of the Row permissions Tab inherits the visibility of the Permissions Tab on the table details page; the clickability of the + Grant > Row permissions button inherits the permissions of the + Grant button itself. |
Scope of supporting capabilities | Advanced security capabilities such as column-level permissions, ABAC policies, and dynamic views are not yet publicly available in the current version and will be gradually rolled out in subsequent versions. |
WHERE clause fragment, for example, year > 2010 AND country != 'US'.Parameter | Description | Required | Default Value | Value Range |
Authorized object | Select the principal to which the row rule applies. You can switch between users and user groups, and fuzzy search, multi-select, and select all are supported. | Yes | - | Existing Users / User Groups in the Current Workspace |
Row filtering expression | A standard SQL WHERE clause fragment. Referenced fields must be actual fields in the table. Maximum length: 2000 characters. | Yes | - | For example, region = 'south', year > 2010 AND country != 'US' |
SELECT * FROM <table_name> in Studio. The returned row set contains only rows that meet the expression condition.region = 'south' and the user rule is vip = true, the rows ultimately visible to this user are all records where region = 'south' or vip = true.WHERE clause fragment. You can use common syntax such as comparison operators (= != > < >= <=), logical operators (AND OR NOT), IN lists, BETWEEN, and LIKE. The supported functions and operators depend on the actual capabilities of the underlying engine. We recommend that you use the Validate feature during editing to verify whether the expression is valid.Apakah halaman ini membantu?
Anda juga dapat Menghubungi Penjualan atau Mengirimkan Tiket untuk meminta bantuan.
masukan