Connectors

Control which rows and columns people see

Share one table with your team and let each person see only the rows and columns they're allowed to.

With access rules, everyone you share a table with works from the same table, and each person sees only as much of it as you allow. You set the rules on the table's share sheet.

This page follows one example: a Deals table from your sales database, with Region, Rep, Amount and Margin columns. Each sales rep should see only their own region's deals, and only the Finance team should see Margin.

How access rules work

  • The rule for everyone else applies to everyone the table is shared with who has no rule of their own. Without it, they see all rows and columns.
  • A rule for a person, a team or the workspace is an exception. Someone with an exception gets their exception instead of the rule for everyone else.
  • Several exceptions add up. If more than one applies to someone, they see the rows of each, and none of the columns any of them hides.
  • The table's owner always sees everything. Rules apply to everyone else the table is shared with, admins included.

Rules belong to the table. Sharing the table with someone, or removing their access, doesn't add or remove a rule.

Before you start

  • You need the Enterprise plan to create or change a rule.
  • The table's owner and the workspace's admins manage its rules.
  • Share the table first: open it from its database's page and choose Share. Rules apply to the people it's shared with.

Set the rule for everyone else

In the example, every rep sees only deals in their own region, and nobody sees Margin.

  1. Open the table and choose Share, then choose People with access.
  2. Next to Everyone else, choose Rows and columns….
  3. Under Rows, choose Only rows where….
  4. Choose a Column (Region) and a Condition (is).
  5. Choose Member attribute, then choose the Attribute (region). To compare with a fixed value instead, choose Value and type it.
  6. Under Hidden columns, select Margin.
  7. Choose Save.

If the rule narrows what people without a rule of their own see, Dvina asks first and says how many people or teams it affects.

Under Rows, you can also choose All rows, or No rows so that the rule shows no rows at all.

Tip

A condition compares the column in a way that fits its type: text columns can be is, is not, contains or doesn't contain, number columns can be more or less than a value, and date columns can be before, after or between dates. Any column can have a value or be empty.

Add an exception for a person or a team

The Finance team should see every deal, with Margin.

  1. In People with access, find the Finance team. Open the menu next to it, which shows its role, like Can view.
  2. Choose Rows and columns….
  3. Under Rows, choose All rows, and leave every column under Hidden columns cleared.
  4. Choose Save.

Each line in People with access says what that person or team sees, like All rows or Some rows, 1 column hidden. If two exceptions hide different columns, Dvina tells you that someone both apply to sees neither rule's hidden columns.

A rule for the workspace applies to everyone in it together with their own rules, so the rows of both add up.

Give members attributes

A rule that compares a column with a member attribute shows each person the rows that match their own value. In the example, a rep whose region is West sees only the West deals. Attributes need the Enterprise plan, and admins set them.

  1. In Settings › People, choose Member Attributes.
  2. Type a New attribute, like region, and choose Add. Use lower case letters, digits and underscores, starting with a letter.
  3. In People, open a member's role menu and choose Member Attributes.
  4. Type their value, like West. Separate several values with commas, like West, Central, to show the rows of each.
  5. Choose Save.

With SCIM, department, cost_center, division, organization, employee_number, title and user_type come from your identity provider.

Important

Someone whose attribute isn't set sees no rows from a rule that compares with it. They see Restricted view with a note to ask an admin to set it. Removing an attribute means access rules comparing with it no longer match anyone.

What people see

Rules apply everywhere the table is queried: answers in chat, cards, card exports and insights.

  • Restricted view marks a card or an insight that a rule narrows for you.
  • A column hidden from someone doesn't appear for them at all. If they ask for it, the query is refused as if the column didn't exist.
  • When a rule shows someone no rows, Dvina doesn't ask the database.
  • When Dvina describes the table to someone with a rule, it leaves out hidden columns and descriptions made from rows they may not all see.
  • On the database's page, tables with access rules show Restricted view.

Shared insights and chats

  • Someone with a rule who opens a shared insight sees their own result, not yours.
  • When you share a chat, a task or a thread whose cards query a table, Dvina names the people whose rules limit what they see. Their cards show data as their access allows, but the text of the answers shows figures as you saw them.

See who queried a table

Each query on a table with access rules, and each query by someone the table is shared with, is recorded in the audit log.

  1. In People with access, choose Who queried this table.
  2. Choose an entry to see When, Who, how many Rows came back and where the query came From: Chat, Card, Insight or Other.

Admins also find these events under Tables in Settings › Audit Log. Seeing who queried a table needs the Enterprise plan.

Delete a rule

  1. Open the rule from People with access.
  2. Choose Delete rule. When deleting it lets someone see more, Dvina asks first and says who; choose Delete rule to confirm.

Plans

Creating and changing rules, member attributes and Who queried this table come with the Enterprise plan. Rules you've already saved keep applying on every plan, and you can still see and delete them.