# Control which rows and columns people see

> Share one table with your team and let each person see only the rows and columns they're allowed to.

With access rules, everyone you share a table with works from the same table, and each person sees only as much of it as you allow. You set the rules on the table's share sheet.

This page follows one example: a **Deals** table from your sales database, with **Region**, **Rep**, **Amount** and **Margin** columns. Each sales rep should see only their own region's deals, and only the Finance team should see **Margin**.

## How access rules work

- **The rule for everyone else** applies to everyone the table is shared with who has no rule of their own. Without it, they see all rows and columns.
- **A rule for a person, a team or the workspace** is an exception. Someone with an exception gets their exception instead of the rule for everyone else.
- **Several exceptions add up.** If more than one applies to someone, they see the rows of each, and none of the columns any of them hides.
- **The table's owner always sees everything.** Rules apply to everyone else the table is shared with, admins included.

Rules belong to the table. Sharing the table with someone, or removing their access, doesn't add or remove a rule.

## Before you start

- You need the Enterprise plan to create or change a rule.
- The table's owner and the workspace's admins manage its rules.
- Share the table first: open it from its database's page and choose **Share**. Rules apply to the people it's shared with.

## Set the rule for everyone else

In the example, every rep sees only deals in their own region, and nobody sees **Margin**.

1. Open the table and choose **Share**, then choose **People with access**.
2. Next to **Everyone else**, choose **Rows and columns…**.
3. Under **Rows**, choose **Only rows where…**.
4. Choose a **Column** (**Region**) and a **Condition** (**is**).
5. Choose **Member attribute**, then choose the **Attribute** (`region`). To compare with a fixed value instead, choose **Value** and type it.
6. Under **Hidden columns**, select **Margin**.
7. Choose **Save**.

If the rule narrows what people without a rule of their own see, Dvina asks first and says how many people or teams it affects.

Under **Rows**, you can also choose **All rows**, or **No rows** so that the rule shows no rows at all.

> [!TIP]
> A condition compares the column in a way that fits its type: text columns can be **is**, **is not**, **contains** or **doesn't contain**, number columns can be more or less than a value, and date columns can be before, after or between dates. Any column can have a value or be empty.

## Add an exception for a person or a team

The Finance team should see every deal, with **Margin**.

1. In **People with access**, find the Finance team. Open the menu next to it, which shows its role, like **Can view**.
2. Choose **Rows and columns…**.
3. Under **Rows**, choose **All rows**, and leave every column under **Hidden columns** cleared.
4. Choose **Save**.

Each line in **People with access** says what that person or team sees, like **All rows** or **Some rows, 1 column hidden**. If two exceptions hide different columns, Dvina tells you that someone both apply to sees neither rule's hidden columns.

A rule for the workspace applies to everyone in it together with their own rules, so the rows of both add up.

## Give members attributes

A rule that compares a column with a member attribute shows each person the rows that match their own value. In the example, a rep whose `region` is West sees only the West deals. Attributes need the Enterprise plan, and admins set them.

1. In Settings › **People**, choose **Member Attributes**.
2. Type a **New attribute**, like `region`, and choose **Add**. Use lower case letters, digits and underscores, starting with a letter.
3. In **People**, open a member's role menu and choose **Member Attributes**.
4. Type their value, like `West`. Separate several values with commas, like `West, Central`, to show the rows of each.
5. Choose **Save**.

With SCIM, `department`, `cost_center`, `division`, `organization`, `employee_number`, `title` and `user_type` come from your identity provider.

> [!IMPORTANT]
> Someone whose attribute isn't set sees no rows from a rule that compares with it. They see **Restricted view** with a note to ask an admin to set it. Removing an attribute means access rules comparing with it no longer match anyone.

## What people see

Rules apply everywhere the table is queried: answers in chat, cards, card exports and insights.

- **Restricted view** marks a card or an insight that a rule narrows for you.
- A column hidden from someone doesn't appear for them at all. If they ask for it, the query is refused as if the column didn't exist.
- When a rule shows someone no rows, Dvina doesn't ask the database.
- When Dvina describes the table to someone with a rule, it leaves out hidden columns and descriptions made from rows they may not all see.
- On the database's page, tables with access rules show **Restricted view**.

### Shared insights and chats

- Someone with a rule who opens a shared insight sees their own result, not yours.
- When you share a chat, a task or a thread whose cards query a table, Dvina names the people whose rules limit what they see. Their cards show data as their access allows, but the text of the answers shows figures as you saw them.

## See who queried a table

Each query on a table with access rules, and each query by someone the table is shared with, is recorded in the audit log.

1. In **People with access**, choose **Who queried this table**.
2. Choose an entry to see **When**, **Who**, how many **Rows** came back and where the query came **From**: **Chat**, **Card**, **Insight** or **Other**.

Admins also find these events under **Tables** in Settings › **Audit Log**. Seeing who queried a table needs the Enterprise plan.

## Delete a rule

1. Open the rule from **People with access**.
2. Choose **Delete rule**. When deleting it lets someone see more, Dvina asks first and says who; choose **Delete rule** to confirm.

## Plans

Creating and changing rules, member attributes and **Who queried this table** come with the Enterprise plan. Rules you've already saved keep applying on every plan, and you can still see and delete them.

## Related

- [Databases and warehouses](/docs/connectors/databases)
- [Members and roles](/docs/teams/members-and-roles)
- [Use the audit log](/docs/teams/audit-log)
- [Sharing](/docs/use-dvina/features/sharing)