Skip to content
AskTable

Documentation feedback

Current pageDesign data permissions/en/permissions/design

0 / 5,000

Your feedback will be sent to the maintenance team.

Go to console
Go to console
AskTable
Go to console

Members and permissions

Design data permissions by department and region

Use one data role with a variable so each person sees only the data they are responsible for.

This tutorial shows a common permission design: salespeople can see only orders in their own region and cannot see customer phone numbers, while management can see all data.

Scenario

The data source has an orders table sales.orders with fields such as region, amount, and customer_phone.

PersonData they should see
East China salesEast China orders, without customer phone numbers
South China salesSouth China orders, without customer phone numbers
ManagementAll orders

Design approach

  • Distinguish regions with a variable, not separate roles. Create one “Regional sales” role with a variable region instead of separate “East China sales” and “South China sales” roles. However many regions there are, you maintain one role.
  • Allow policies set the scope; deny policies remove sensitive fields. One allow policy limits the visible table and rows, and one deny policy excludes phone numbers.
  • Management gets no role. No data role means “All data”, still limited by the agent's data sources.

This requires a project owner or project administrator. Entry: “More” → “Data Access Control”.

Steps

Create an allow policy for table and rows

Create a policy “Orders - own region”, choose “Allow”, and add the data source.

  • Field-level rule: table name “Exact match” orders.
  • Row-level filter: table sales.orders, field region, operator =, value source “Role variable”, variable name region.

Create a deny policy for phone numbers

Create a policy “Hide customer phone”, choose “Deny”, add the same data source, with the field-level rule: field name “Exact match” customer_phone.

Create the role

Create a role “Regional sales” and add both policies in “Applied policies”. In “Data scope preview”, confirm that orders is visible and customer_phone is not.

Assign to members

In “Project settings” → “Project members”, choose “Regional sales” for East China salespeople and set region to East China; for South China, set South China.

If enterprise identity integration is configured and department data is synced, set region to reference the member's department profile so transfers take effect automatically. See Members and roles.

Do not assign a data role to management.

Check the outcome

  • Ask “sales by region last month” with an East China salesperson's account; the result includes only East China.
  • Ask “list customer phone numbers”; the agent explains that it cannot access the field.
  • Ask with a management account; the result includes all regions.

If an East China salesperson sees “Data access configuration is incomplete”, region is not filled in; complete the variable in “Project members”.

Going further

  • When someone needs several values (for example, responsible for two regions), choose “SQL (advanced)” as the row filter's value source and use a multi-value variable.
  • For askers in Feishu groups, authorize the same role with its variables in the agent's “People permissions”. See Feishu channel user permissions.
  • If you only want the AI not to see real phone numbers but still need to count by them, use masking instead of a deny policy.