Set data access scope

Sidebar “Data access control” → “Policies” → “New policy” at the upper right. Enter a name (up to 25 characters) in the dialog, choose “Allow” or “Deny,” and click “Create” to open the details page.

The details page has three sections from top to bottom: “Basic information,” “Data access rules,” and “Data scope preview.” “Basic information” holds the policy name and permission direction; “Data access rules” selects data sources and configures field-level and row-level rules.

The “Data sources” section supports multiple sources; rules apply to all listed sources. Click “Add data source” and select sources in “Select data sources to add.” Before any are added, the section prompts you to add data sources first.

“Field-level rules” controls visibility through matching patterns at three levels: Schema / Table / Field, grouped as “Schema name matching rules,” “Table name matching rules,” and “Field name matching rules.” Click “Add rule” to open its dialog, choose “Exact match,” “Starts with,” “Ends with,” or “Contains,” then enter the matching value. Multiple rules in a group use a conjunction of “Match any” or “Match all.” With no groups configured, access is allowed by default; the section says there are no rules and all schemas match by default.

“Row-level filtering” configures WHERE conditions separately for each data source and works only for allow policies. Click “Add filter” and select a data source, schema, table, field, and operator in “Add row-level filter,” then enter the value. This section is hidden for “Deny” policies. Attempting to configure it is rejected with a message that deny policies cannot have row filters.

“Data scope preview” shows the policy's visible scope in real time, collapsed by default. Expand by data source to see visibility statistics at schema, table, and field levels. If the policy has no data sources, it says the policy does not target any data source.

Sidebar “Data access control” → “Roles” → “New role”; enter a name and click “Create.” “Applied policies” on the details page binds policies to the role and determines data access. Click “Add policy” and select in its dialog. When all are added, a message says all policies have been added; an empty list says no policies are bound yet. “Data scope preview” below shows the final visible scope after merging allow and deny policies.

Sidebar “Data access control” → “People,” which opens the “Registered” tab by default. Click “New person,” enter a name (required), email, phone number, and notes, then click “Create profile.” Columns are name, email, phone, channel bindings, and creation time. After Feishu is linked, Channel bindings shows Feishu and the binding count; otherwise it shows Unbound. A Feishu user's first question automatically enters “Pending approval.”

Do this on the Agent: open the target Agent → top “Channels” tab → “People” section (shown only after enabling the Feishu channel) → turn on Enable allowlist → click “Add person,” select a person and role, then click “Authorize.” If no role is selected, the dropdown shows “Do not select any role” and explains that the user defaults to the data Agent's access scope, including all data configured for it. After authorization, the Role column labels such entries as full access when no role is specified.