Understanding data permissions

The most limited permission scope gives users access to data filtered by a specific table, column, and value. In the following permission table, the user test-user@celonis.com is given permission to see data from the Purchase Orders table if the company_code column has a value of c1:

Because of permission cascading, this filter on the Parent table (Purchase Orders) automatically restricts the user's view of the Child table (Purchase Order Items) to only those items belonging to company c1. This also means all other purchase orders and their associated items in the Child table are restricted.

With this data permission, the user is granted access to the following data:

To understand the results in the child table below, note that the c1_or_m1 column serves as a logic flag. For this example, assume records marked with yes are associated with company c1 to satisfy the parent-level permission.

When you specify multiple values for a single column, permissions are combined into a logical OR condition. This is processed as an IN list (for example, FILTER table.column IN (val1, val2)). Under this logic, a user can see any record that matches at least one of the specified values.

In a permission table, these are defined as multiple rows for the same user. In this example, the user test-user@celonis.com is granted permission to see entries in the Purchase Order Items table that involve either material m1 or material m6:

With this configuration, the engine restricts the Purchase Order Items table to the permitted materials. Because of the relational link, the Purchase Orders (Parent) table is also filtered; the user only sees orders that contain at least one permitted item.

With this data permission, the user is granted access to the following data:

When you specify permissions for multiple columns within the same table, the engine combines them using a logical AND condition. This is a restrictive configuration where the user can only view rows that satisfy all criteria simultaneously.

In this example, the user test-user@celonis.com is granted permission to see items in the Purchase Order Items table only where the po_number is p4 AND the material_number is m1:

Using the reference data, the permissions are evaluated against each row using both conditions:

With this configuration, the user can only access the middle row (item i4 of order p4). The other rows fail to meet both conditions and would be excluded. For instance, items from order p1 would be excluded because the order number is not p4, and item i3 would be excluded because it lacks the material m1 (as seen in the Data Example table).

Permissions can also be enforced that span multiple columns across different tables. When permissions are defined for more than one table or column, they are combined using a logical AND condition. This means a user can only view data that satisfies the criteria in all specified permissions.

In this example, the user test-user@celonis.com is granted permission to see data only when the Purchase Orders (Parent) match company c1 AND the Purchase Order Items (Child) involve either material m1 or material m6:

Because of the cross-table AND logic, this permission filters out any material (including m1 or m6) if it belongs to a company other than c1. Likewise, it filters out company c1 records if they do not contain the specified materials (m1 or m6).

With this data permission, the user is granted access to the following data:

Standard permission configurations combine different columns using AND logic (as seen in Case 4). However, you may need a user to see records matching criteria from either one column or another; for example, they may need access to orders for company c1 OR all items involving material m1.

To achieve this cross-column OR logic, you must add a "flag" column to your Data Model. In our reference data, the column c1_or_m1 serves this purpose. This column is pre-calculated to contain the value yes if the record matches company code c1, material number m1, or both.

In the permission table, you then grant access based solely on this flag column. This allows the complex logic to be handled by the Data Model while keeping the permission rule simple:

By filtering on this single flag, the permission table grants the user access to every purchase order and item connected to either company c1 or material m1: