Row-Level Security in BI: How to Show Each Person Only Their Own Data

Every BI platform can show different people different data. The hard part is not turning the feature on. The hard part is making sure it holds everywhere a number can appear, because the mistakes here are quiet. Nobody sees an error. Someone just sees a figure they were not meant to see.

What row-level security means

Row-level security limits which rows of data a person can see. A plant manager sees rows for their plant. A sales director sees rows for their region. A client sees rows for their own account. Everyone looks at the same dashboard, but the numbers underneath are filtered by who is looking.

It is different from controlling which reports a person can open. Report access decides whether you can open the sales dashboard. Row-level security decides which sales rows are in it when you do. Most businesses need both.

Start with the access model, not the tool

Before configuring anything, write down who should see what. List the groups of people, the field that divides the data (department, region, branch, company, client), and what leadership sees. Decide whether a person can have more than one value, such as a regional manager with two regions. Decide what happens to a person who is not covered by any rule. The safest answer is that they see nothing until someone assigns them.

Using groups instead of individual rules saves a lot of pain later. When someone changes roles, you move them between groups instead of editing a list of exceptions.

Where limits leak

A limit enforced only inside a report is easy to bypass. These are the places to check.

Exports. A person who cannot see a region on screen can sometimes download a file that includes it. Exports must be built with the same limits as the screen.

Scheduled emails. A report sent on a schedule is generated by the system, not by the person, so it needs to be built within that recipient's limits, not the owner's.

Shared links. A link to a report can carry more access than the person who receives it should have. Links need to be frozen to what their creator could see, and set to expire.

Drill-through. Clicking a number to see the rows behind it should show only the rows that person is allowed to see.

Filter lists. A dropdown that lists every region name tells a person that other regions exist, and sometimes more. Filter options should respect limits too.

Totals and averages. A company-wide total shown to a person limited to one branch reveals information about everyone else. Decide deliberately whether that is acceptable, and if not, restrict it.

APIs and connected tools. Anything that pulls numbers into a spreadsheet or another system has to apply the same limits.

Enforce it on the server

The most reliable approach is to apply the limit at the server, on every query, instead of relying on each report to remember to filter. That way a new chart, a new export or a new integration inherits the limit automatically, because there is no unfiltered path to the data.

Fail closed

When something is ambiguous, the system should show less, not more. If a report cannot honor a person's limit, for example because it uses a field the limit does not apply to, the right behavior is to hide that report from that person rather than show unfiltered numbers. A broken limit that hides a report gets reported by an annoyed user within a day. A broken limit that leaks data can go unnoticed for years.

How to test it

Create test users for each kind of person and sign in as them. Compare their totals with the underlying data. Try to export. Trigger a scheduled email and read it. Open a shared link in a private window. Click through to the detail rows. Check the filter dropdowns. Keep a record, and repeat the test whenever you add a new type of report or change how people are grouped.

An activity log helps a lot here, because it tells you who exported what and when.

How Horizon handles it

In Horizon, limits are set per person or per group by department, region, branch, company or any field you define. They are applied on the server to every chart, filter, drill-through, export, email and API call. If a report cannot honor a person's limit, Horizon hides it from that person instead of showing too much. People and groups can be kept in step with your directory, so access changes when roles change.

If you need to show different people different slices of the same data and want the access model reviewed before it goes live, reach out.