---
alias: user-guide-data-set-security-permissions
tags:
- data platform
description: "This document outlines data set security permissions based on entity type and object-level settings"
---

# Data Sets Security Permissions

## Overview

The **Data Sets** (as well as, Analytics Views and IoT Events Definitions) are protected by the object security level. For more information, see [[security-admin#security-levels|Security Levels]].

Object-level security controls what you can do with a **Data Set**. It does not control which rows the query returns, which is described in [Data Access Security](#data-access-security).

## Object-Level Behavior in Data Sets

{% include-markdown 'includes/pages/security_permissions_data_platform.md' %}

## Detailed Permissions Matrix

The table below summarizes all possible permission combinations for Data Sets, based on whether the entity is System or Non-System, and whether object-level security is On or Off.

| Entity Type    | Object-Level | Action                       | Administrator | User (No Data Group) | User (Read Access) | User (Write Access) | Access Notes                                               |
| -------------- | ------------ | ---------------------------- | ------------- | -------------------- | ------------------ | ------------------- | ---------------------------------------------------------- |
| **System**     | **Off**      | Edit                         | :material-close:{ style="color: #EF5350" } | :material-close:{ style="color: #EF5350" } | :material-close:{ style="color: #EF5350" } | :material-close:{ style="color: #EF5350" } | System entities cannot be edited when Object-Level is off. |
| **System**     | **Off**      | Import                       | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Allowed. |
| **System**     | **Off**      | Import via Integration Entry | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Allowed. |
| **Non-System** | **Off**      | Edit                         | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Allowed. |
| **Non-System** | **Off**      | Edit Query / Fields           | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Allowed. |
| **Non-System** | **Off**      | Import                       | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Allowed. |
| **System**     | **On**       | Edit                         | :material-check:{ style="color: #4DB6AC" } | :material-alert:{ style="color: #FFB300" } Forbidden query and fields | :material-close:{ style="color: #EF5350" } | :material-alert:{ style="color: #FFB300" } Forbidden query and fields | Users with Write Access or no Data Group can edit only partial fields or queries. |
| **System**     | **On**       | View                         | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Full viewing access. Users with no access cannot view. |
| **System**     | **On**       | Terminate                    | :material-close:{ style="color: #EF5350" } | :material-close:{ style="color: #EF5350" } | :material-close:{ style="color: #EF5350" } | :material-close:{ style="color: #EF5350" } | Termination not allowed. |
| **System**     | **On**       | Import                       | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Allowed. |
| **System**     | **On**       | Import via Integration Entry | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Allowed. |
| **Non-System** | **On**       | Edit                         | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-close:{ style="color: #EF5350" } | :material-check:{ style="color: #4DB6AC" } | Allowed except for Read Access users. |
| **Non-System** | **On**       | View                         | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Allowed. |
| **Non-System** | **On**       | Terminate                    | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Allowed. |
| **Non-System** | **On**       | Import                       | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | :material-check:{ style="color: #4DB6AC" } | Allowed. |

Table: Data Sets permissions matrix

!!! info
    On the Details page of each Data Set, the Owner Type property indicates whether the event is a System or Non-System Data Set.

## Data Access Security

Access to a **Data Set** and the rows it returns are controlled separately. The **Data Group** assigned to the **Data Set** itself determines whether you can open and query it. **Data Access Security** then determines which rows the query returns once you are allowed to run it, according to the **Data Groups** that your roles grant access to. You can have access to a **Data Set** and still receive no rows from it, if your roles grant access to none of the **Data Groups** carried by the data.

The restriction is applied to the ClickHouse table that the query reads, not to the **Data Set**, so you neither configure it nor disable it on the **Data Set** itself. When the query reads a protected table, the results are restricted whether or not the query returns the columns that carry the **Data Group** values. When it reads a table that is not protected, every row is returned.

Whether a table is protected depends on where its data comes from. A table built from an **IoT Event Definition** is protected when the definition names at least one object to protect, and a table replicated from the MES is protected when it carries a **Data Group** column. Data Warehouse tables and tables from a Data Silo are never protected.

### Rows Are Removed, Column Values Are Not

The restriction removes whole rows rather than hiding the value of a column. A row of a **Data Set** can carry columns that describe several objects, and only one of those objects drives the filtering, so every column of a row that you can reach is readable, including an attribute of an object that your roles do not grant access to.

Take this into account when you choose the fields of a **Data Set**, and leave out of the query any column that must not reach its users.

### Joins

Each table of the query is filtered on its own before the join runs, so a joined row is returned only when you can reach the matching row on both sides.

![Two overlapping sets of rows, Table A and Table B. Each table is filtered by its own row policy first. Only the matching rows that the caller reaches in both tables reach the result.](../../../../operationguide/system-administration/security/diagrams/row_policy_join.drawio.svg)

!!! info "Data Set returning fewer rows than expected"
    If a Data Set returns fewer rows than you expect, or none at all, the row policies of the table behind it are a likely cause. To confirm whether that data is protected, ask your system administrator to list the row policies of the database. For more information, see [[operation-guide-data-set-data-access-security|Data Set Data Access Security]].