In Datarails, what data a person can see is controlled by their access to data tables. This article shows you how to give someone access to a table, limit what they see in it with a permission filter, and turn off drill-down.
New permissions model: This article describes the new permissions model, which is rolling out gradually. If your screen looks different, your organization may not have it yet.
How data access works
- Tables control data. Access to a table decides what data a person sees everywhere that table is used: reports, dashboards, Excel functions, metrics and AI Agents.
- Elements control what a person can open. Sharing a dashboard or report space lets someone open it. It doesn't give them the data inside it. They also need access to the tables behind it.
- A permission filter narrows a Viewer's data. For example, a filter on Department lets someone see only the Finance rows of a table.
Table access levels
| Level | What it allows | Who can have it |
|---|---|---|
| Viewer | See the table's data in any output shared with them. You can limit a Viewer with a permission filter. | Any role except Super Admin |
| Owner | See all of the table's data, edit and delete the table, and manage who has access. A permission filter can't be applied to an Owner. | Manager, Admin and Super Admin |
Tables have no Editor level.
Before you start
- To change access to a table, you need to be an Owner of that table or a Super Admin.
- The steps below use a member's profile. They work the same way for a group: open the group's profile from the Groups tab instead.
Giving a member access to a table
- In the left navigation, open Admin and click Members & groups.
- On the Members tab, click the member's name to open their profile.
-
Under Permissions, in the Data tables section, click the arrow next to Tables to see the list of tables.
- If the table you need isn't listed, click See more to show the full list, and make sure Show only shared tables is cleared.
-
Next to the table, open the access list and select Viewer or Owner. To remove access, select No access. The list shows only the levels the member's role allows, so Owner doesn't appear for Viewers and Collaborators.
The change takes effect immediately. A Viewer with no permission filter sees all of the table's data.
Limit what a Viewer sees with a permission filter
- In the member's profile, find the table in the Data tables section. The member must have Viewer access to it.
-
Click Manage data access next to the table. The Manage data access panel opens.
-
Under Filters, click Add filter.
-
Under Select field, choose the field to filter on, such as Department, Region or Entity. Keep Dimensions only turned on so that the list shows only dimensions.
Filter on dimensions: If you filter on a field that isn't a dimension, the member loses access to metrics based on that table. Datarails warns you before you do this, and marks the table's filter badge with a warning icon.
-
Choose Include to list the values the member can see, or Exclude to list the values to hide. Then select the values. For a date field, set the From and To dates instead.
-
Click Apply filter.
-
To add another condition, click Add filter again and repeat the steps. To remove a filter, click the × next to it.
After you add a filter, the table shows a badge with the number of filters, such as 2 filters. To change them later, click the edit (pencil) icon next to the badge.
The panel lists the member's current filters.
Several filters work together: When a member has more than one filter on a table, they see only the rows that match all of them. For example, Department = Finance and Region = EMEA shows only Finance rows in EMEA. The same applies when the member gets the table through more than one group: all the groups' filters are combined.
Turn off drill-down for a Viewer
By default, a member with a permission filter can drill down only into the rows their filter allows. You can also turn drill-down off completely, so the member sees totals but never the rows behind them.
- In the member's profile, click Manage data access next to the table. If the table already has filters, click the edit (pencil) icon instead.
-
Turn off the Drill Down toggle. It is on by default.
What this doesn't cover: Turning off drill-down hides row-level detail in outputs. It doesn't stop someone who can build their own outputs from the same table. To prevent that, limit their access to the table itself.
What members see with a filter
- Metrics such as Total Revenue or Headcount are calculated only from the rows the member is allowed to see.
- Values outside the filter don't appear in dropdowns, filters or drill-downs.
- Two people can open the same dashboard and see different numbers, because each sees only their own rows.
Replace a migrated Filebox filter
When your organization moved to the new permissions model, Datarails created filters automatically so that nobody gained or lost access. A member who had access to only some of a table's Fileboxes received a filter that lists those Filebox IDs.
Migrated filters don't update: A migrated filter lists the Fileboxes the member could see on the day of the migration. Fileboxes, scenarios and entities added later aren't included. When new data arrives outside the list, the member's reports and dashboards show 0 or blank cells, with no error.
If a member reports blank or zero values in new data:
- Open the member's profile and find the table in the Data tables section.
- Click the edit (pencil) icon next to the filter badge to open Manage data access.
- Check whether the filter is based on Filebox IDs.
- Replace it with a filter that matches how your business is organized, such as cost center, region, entity or scenario. Follow the steps in Limit what a Viewer sees with a permission filter.
Adding the missing Filebox to the old filter fixes the problem for now. Replacing the filter fixes it permanently, because the new filter keeps working as Fileboxes are added.
© Datarails Ltd. All rights reserved.
Updated