Data Sets Security Permissions#

Overview#

The Data Sets (as well as, Analytics Views and IoT Events Definitions) are protected by the object security level. For more information, see Security Levels.

Object-level security controls what you can do with a Data Set. It does not control which rows the query returns, which is described in Data Access Security.

Object-Level Behavior in Data Sets#

The following rules apply when Object-Level Security is Off or On for Analytics Views, IoT Events, and Data Sets.

Object-Level Off#

Entity Type	Permission Summary
System Entities	You can view but cannot edit or modify layout.
Non-System Entities	You can view and edit normally.

Table: Permissions summary for Object-Level Off

Object-Level On#

Use Case	Permission Summary
Entity without Data Group	You can edit Non-System entities normally, and edit only the first step of the Edit Wizard for System entities (layout editing is forbidden).
User with Read Access	You can view but cannot edit or modify layout.
User with Write Access	You can edit Non-System entities normally, and edit only the first step of the Edit Wizard for System entities (layout editing is forbidden).

Table: Permissions summary for Object-Level Off

Detailed Permissions Matrix#

The table below summarizes all possible permission combinations for Data Sets, based on whether the entity is System or Non-System, and whether object-level security is On or Off.

Entity Type	Object-Level	Action	User (No Data Group)	User (Write Access)	Access Notes
System	Off	Edit			System entities cannot be edited when Object-Level is off.
System	Off	Import			Allowed.
System	Off	Import via Integration Entry			Allowed.
Non-System	Off	Edit			Allowed.
Non-System	Off	Edit Query / Fields			Allowed.
Non-System	Off	Import			Allowed.
System	On	Edit	Forbidden query and fields	Forbidden query and fields	Users with Write Access or no Data Group can edit only partial fields or queries.
System	On	View			Full viewing access. Users with no access cannot view.
System	On	Terminate			Termination not allowed.
System	On	Import			Allowed.
System	On	Import via Integration Entry			Allowed.
Non-System	On	Edit			Allowed except for Read Access users.
Non-System	On	View			Allowed.
Non-System	On	Terminate			Allowed.
Non-System	On	Import			Allowed.

Table: Data Sets permissions matrix

Info

On the Details page of each Data Set, the Owner Type property indicates whether the event is a System or Non-System Data Set.

Data Access Security#

Access to a Data Set and the rows it returns are controlled separately. The Data Group assigned to the Data Set itself determines whether you can open and query it. Data Access Security then determines which rows the query returns once you are allowed to run it, according to the Data Groups that your roles grant access to. You can have access to a Data Set and still receive no rows from it, if your roles grant access to none of the Data Groups carried by the data.

The restriction is applied to the ClickHouse table that the query reads, not to the Data Set, so you neither configure it nor disable it on the Data Set itself. When the query reads a protected table, the results are restricted whether or not the query returns the columns that carry the Data Group values. When it reads a table that is not protected, every row is returned.

Whether a table is protected depends on where its data comes from. A table built from an IoT Event Definition is protected when the definition names at least one object to protect, and a table replicated from the MES is protected when it carries a Data Group column. Data Warehouse tables and tables from a Data Silo are never protected.

Rows Are Removed, Column Values Are Not#

The restriction removes whole rows rather than hiding the value of a column. A row of a Data Set can carry columns that describe several objects, and only one of those objects drives the filtering, so every column of a row that you can reach is readable, including an attribute of an object that your roles do not grant access to.

Take this into account when you choose the fields of a Data Set, and leave out of the query any column that must not reach its users.

Joins#

Each table of the query is filtered on its own before the join runs, so a joined row is returned only when you can reach the matching row on both sides.

Data Set returning fewer rows than expected

If a Data Set returns fewer rows than you expect, or none at all, the row policies of the table behind it are a likely cause. To confirm whether that data is protected, ask your system administrator to list the row policies of the database. For more information, see Data Set Data Access Security.