lookml-access-grants

Instructions

1. Define Access Grant:

• Defined at the Model level.
• Links a user_attribute to a set of allowed_values.

1. Apply Access Grant:

• Use required_access_grants: [grant_name] at the Explore, Join, View, or Field level.
• User must match all listed grants to see the object.

1. Best Practices:

• Exact Match: allowed_values must match the user attribute value distinctively (no wildcards/partial matches).
• Additive: Grants are additive. If a View requires Grant A and a Field requires Grant B, the user needs both to see the field.

Examples

Basic Access Grant

# In model file
access_grant: can_view_finance {
  user_attribute: department
  allowed_values: ["finance", "executive"]
}

# In view file
view: finance_data {
  required_access_grants: [can_view_finance]
  # ...
}

Field-Level Security

dimension: salary {
  type: number
  sql: ${TABLE}.salary ;;
  required_access_grants: [can_view_finance]
}