# Design data permissions by department and region

Use one data role with a variable so each person sees only the data they are responsible for.

使用指南 · 模块: permissions · 管理人员 · 部署形态：资料未说明 · 已确认产品版本：资料未说明 · 来源：编辑整理 · 按产品 4.2.76-1110（CLI 0.0.18）核对；私有部署的旧版本可能不包含近期变化。

This tutorial shows a common permission design: salespeople can see only orders in their own region and cannot see customer phone numbers, while management can see all data.

## Scenario

The data source has an orders table `sales.orders` with fields such as `region`, `amount`, and `customer_phone`.

| Person            | Data they should see                               |
| ----------------- | -------------------------------------------------- |
| East China sales  | East China orders, without customer phone numbers  |
| South China sales | South China orders, without customer phone numbers |
| Management        | All orders                                         |

## Design approach

- **Distinguish regions with a variable, not separate roles.** Create one “Regional sales” role with a variable `region` instead of separate “East China sales” and “South China sales” roles. However many regions there are, you maintain one role.
- **Allow policies set the scope; deny policies remove sensitive fields.** One allow policy limits the visible table and rows, and one deny policy excludes phone numbers.
- **Management gets no role.** No data role means “All data”, still limited by the agent's data sources.

This requires a project owner or project administrator. Entry: “More” → “Data Access Control”.

## Steps

**Create an allow policy for table and rows**

Create a policy “Orders - own region”, choose “Allow”, and add the data source.

- Field-level rule: table name “Exact match” `orders`.
- Row-level filter: table `sales.orders`, field `region`, operator `=`, value source “Role variable”, variable name `region`.

**Create a deny policy for phone numbers**

Create a policy “Hide customer phone”, choose “Deny”, add the same data source, with the field-level rule: field name “Exact match” `customer_phone`.

**Create the role**

Create a role “Regional sales” and add both policies in “Applied policies”. In “Data scope preview”, confirm that `orders` is visible and `customer_phone` is not.

**Assign to members**

In “Project settings” → “Project members”, choose “Regional sales” for East China salespeople and set `region` to `East China`; for South China, set `South China`.

If enterprise identity integration is configured and department data is synced, set `region` to reference the member's department profile so transfers take effect automatically. See [Members and roles](https://docs.asktable.com/en/organization/members-and-roles).

Do not assign a data role to management.

## Check the outcome

- Ask “sales by region last month” with an East China salesperson's account; the result includes only East China.
- Ask “list customer phone numbers”; the agent explains that it cannot access the field.
- Ask with a management account; the result includes all regions.

If an East China salesperson sees “Data access configuration is incomplete”, `region` is not filled in; complete the variable in “Project members”.

## Going further

- When someone needs several values (for example, responsible for two regions), choose “SQL (advanced)” as the row filter's value source and use a multi-value variable.
- For askers in Feishu groups, authorize the same role with its variables in the agent's “People permissions”. See [Feishu channel user permissions](https://docs.asktable.com/en/permissions/feishu).
- If you only want the AI not to see real phone numbers but still need to count by them, use [masking](https://docs.asktable.com/en/data/hidden-fields) instead of a deny policy.