Access_grant, Access_filter

[tatuspark]

Hi, what is the difference between access_filter and access_grant ? And an example use case. Thanks

[Annie_He · Accepted solution]

Access_grants limit which explores users have access to based off of their user attributes.

Access_filters, on the other hand, limit the data that a user can see in an explore based off of their user attributes.

Suppose we have two users “product_user” and “marketing_user”, and we want to limit the explores/data that they see. They both have a user attribute called “team”. For the product_user, this attribute is set as “product” while for the marketing_user, this is set as “marketing”

Access grants are useful in the case where we have separate explores for specific data. For instance, let’s say we have one explore for products and one explore for marketing, and we only want product users to be able to see/use the products explore - the same goes for the marketing explore. We can do this by defining two separate access_grants in your model file and applying them to the respective explores.

access_grant: product_users {
  user_attribute: team
  allowed_values: [ "product” ]
}

access_grant: marketing_users {
  user_attribute: team
  allowed_values: [ "marketing” ]
}

explore: products {
  required_access_grants: [product_users]
}

explore: marketing {
 required_access_grants: [marketing_users]

}

Note that access_grants aren’t limited to explores. They can also be used for joins, views, and individual fields. More info on that here: https://docs.looker.com/reference/model-params/access_grant

Access filters are useful where we have a single explore and we only want specific users to see certain data. Taking the same users again, suppose that I only want product users to see product data and marketing users to see marketing data in the same explore. We can do something like the following

explore: everything {
 access_filter: {
    field: everything.team #this is a field from your db table
    user_attribute: team
  }
}

A common use case for this is if we have customer data from companies X, Y, and Z. We don’t want users from company X to see any data from company Y, and we don’t want to have to make separate explores for every company we have. Therefore, we just add an access_filter on a single explore that filters on company.

More info on that here: https://docs.looker.com/reference/explore-params/access_filter