Celonis Product Documentation

Here's a basic use case with a permission table that gives user test-user@celonis.com permission to see purchase orders from company C1:

With this data permission, purchase orders P3, P4 and P5 from the example data set are filtered out for the user, because their company code is not C1. Only purchase orders P1 and P2, from company C1, are available for this user to view. Note that the table of purchase order items is also filtered - the user can only see the items from purchase orders P1 and P2.

The PQL engine receives data permissions for a single table column as a chain of FILTER statements. If you specify multiple values that the user can see for a single column, they are combined into a list, for example, FILTER table1.col1 IN (val1, val2, val3). In this situation, users can see the entries with val1, val2, or val3 in column 1 of table 1, but they can't see entries with val4 or val5 in that column.

If you are manually setting data permissions for a user or group, you specify these as multiple values for the same rule. If you are using a permission table, you specify them as multiple rows for the same user, with a different value in each row.

In this permission table we give the user test-user@celonis.com permission to see purchase order items involving either material number M1 or material number M6:

With this data permission, items with materials other than M1 and M6 are filtered out for the user. The table of purchase orders is also filtered - the user can only see the purchase orders that included items with materials M1 and M6.

You can define multiple data permissions for a user or group that reference more than one table column in the data. For example, you could restrict a user to viewing invoices in a specific country and from a specific company. When you define permissions for more than one table column, the user is restricted by all of these permissions. So if you give a user data permissions to see invoices from country CY1 and invoices from company A1, they can't see invoices sent by company A1's subsidiary in country CY2.

In this permission table we give the user test-user@celonis.com permission to see purchase order items involving either material number M1 or material number M6, when they are associated with company C1:

With these data permissions, items with materials other than M1 and M6 and purchase orders other than those associated with company C1 are filtered out for the user. This leaves only one purchase order and one purchase order item.