# Set data access scope Configure people, roles, and policies to control access to projects and data. 使用指南 · 模块: product · 使用者 · 部署形态：资料未说明 · 已确认产品版本：资料未说明 · 来源：现有文档 Data scope is not determined by a single switch: “Project members” determines who can enter a project; “Policies” defines visible schemas, tables, and fields and can filter rows; “Roles” bundles policies; “People” matches Feishu identities to AskTable profiles; and the Agent allowlist links people and roles to a specific Agent. Configure these together when granting data access to a department, store, or job category. ## Before you begin - Permissions: configuring people, roles, and policies requires an effective project owner (OWNER) or administrator (ADMIN) role. Project members (MEMBER) can view resources they can access and ask data questions, but cannot change these management settings. - Entry: left main navigation → “More” → “People,” “Roles,” or “Policies” under “Data access control” in the sidebar. - Configuration order: create policies first, create roles and bind policies next, then authorize people and roles for Agents. Reversing the order produces roles without data sources. ## Steps **Create a policy first** Sidebar “Data access control” → “Policies” → “New policy” at the upper right. Enter a name (up to 25 characters) in the dialog, choose “Allow” or “Deny,” and click “Create” to open the details page. The details page has three sections from top to bottom: “Basic information,” “Data access rules,” and “Data scope preview.” “Basic information” holds the policy name and permission direction; “Data access rules” selects data sources and configures field-level and row-level rules. **Add data sources to the policy** The “Data sources” section supports multiple sources; rules apply to all listed sources. Click “Add data source” and select sources in “Select data sources to add.” Before any are added, the section prompts you to add data sources first. **Configure field-level rules** “Field-level rules” controls visibility through matching patterns at three levels: Schema / Table / Field, grouped as “Schema name matching rules,” “Table name matching rules,” and “Field name matching rules.” Click “Add rule” to open its dialog, choose “Exact match,” “Starts with,” “Ends with,” or “Contains,” then enter the matching value. Multiple rules in a group use a conjunction of “Match any” or “Match all.” With no groups configured, access is allowed by default; the section says there are no rules and all schemas match by default. **Filter rows** “Row-level filtering” configures WHERE conditions separately for each data source and works only for allow policies. Click “Add filter” and select a data source, schema, table, field, and operator in “Add row-level filter,” then enter the value. This section is hidden for “Deny” policies. Attempting to configure it is rejected with a message that deny policies cannot have row filters. **Check the preview** “Data scope preview” shows the policy's visible scope in real time, collapsed by default. Expand by data source to see visibility statistics at schema, table, and field levels. If the policy has no data sources, it says the policy does not target any data source. **Create a role and bind policies** Sidebar “Data access control” → “Roles” → “New role”; enter a name and click “Create.” “Applied policies” on the details page binds policies to the role and determines data access. Click “Add policy” and select in its dialog. When all are added, a message says all policies have been added; an empty list says no policies are bound yet. “Data scope preview” below shows the final visible scope after merging allow and deny policies. **Create a person profile** Sidebar “Data access control” → “People,” which opens the “Registered” tab by default. Click “New person,” enter a name (required), email, phone number, and notes, then click “Create profile.” Columns are name, email, phone, channel bindings, and creation time. After Feishu is linked, Channel bindings shows Feishu and the binding count; otherwise it shows Unbound. A Feishu user's first question automatically enters “Pending approval.” **Authorize people and roles for an Agent** Do this on the Agent: open the target Agent → top “Channels” tab → “People” section (shown only after enabling the Feishu channel) → turn on Enable allowlist → click “Add person,” select a person and role, then click “Authorize.” If no role is selected, the dropdown shows “Do not select any role” and explains that the user defaults to the data Agent's access scope, including all data configured for it. After authorization, the Role column labels such entries as full access when no role is specified. ## Key constraints | Item | Value or default | Where to change it | | ----------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Policy name | Up to 25 characters | “Policies” → “New policy,” or “Basic information” in details | | Permission | “Allow” or “Deny” | Policy details “Basic information” | | Empty field-level rules | Match all schemas, tables, and fields by default | Policy details “Field-level rules” | | “Row-level filtering” | Configurable only for “Allow” policies | Policy details “Row-level filtering” | | Number of “Roles” | Limit 5 (Cloud project resource quota; not enforced in private deployments) | “Roles” page; delete unused roles when over the limit | | Number of “Policies” | Limit 10 (same as above) | “Policies” page | | Number of data sources | Limit 50 (same as above) | “Data sources” page | | Tables per data source | Limit 100, checked during metadata initialization (same as above) | Data source side | | Agent allowlist | Disabled by default, adding no extra filtering | Agent details → “Channels” → “People” | | Public projects | Active organization Owners/Admins/Members enter with the default Admin or Member role; explicit roles take precedence | Project owner adjusts type and default permissions in Project settings; see [Organizations and projects](https://docs.asktable.com/en/organization/overview) | ## Troubleshooting | Symptom | Identifying condition | Resolution | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------ | | User cannot see data | Question rejected with no queryable tables or fields | Check whether the Agent's “Configuration” → “Data sources” is empty; add sources first if so | | Question rejected because table X (schema Y) cannot be found in the data source | The table is outside the visible scope after merging the user's roles | Check the policy's “Data scope preview”; add an “Exact match” field-level rule if needed | | Saving a person, role, or policy is rejected | The current effective project role lacks management permissions | Have a project owner or administrator perform the action, or change the member's explicit project role | | “New role” is rejected | “Roles” already has 5 entries; the API returns `RESOURCE_QUOTA_EXCEEDED` | Delete unused roles on the “Roles” page | | Deleting a role is rejected because multiple Agent allowlists reference it | An Agent allowlist still uses this role | Remove the authorization in each relevant Agent's “People” section first, or replace the role | | No “Add filter” in “Row-level filtering” | The policy's permission direction is “Deny” | Row filters work only for “Allow” policies; use an “Allow” policy for row restrictions | | “Data scope preview” says the policy targets no data source | No data source has been added to the policy | Click “Add data source” in “Data sources” | | Role “Data scope preview” says bound policies target no data source | None of the role's bound policies has a data source | Add “Data sources” to each policy | ## Next steps - Authorize people and roles for specific Agents to control data questions in Feishu groups: /en/permissions/feishu - Create and configure a data Agent: /en/agent/overview - Turn repeated analysis steps into skills: /en/agent/skill