# How do I limit access to columns based on user attributes? (Column-level Permissions)

**URL:** <https://community.omni.co/t/how-do-i-limit-access-to-columns-based-on-user-attributes-column-level-permissions/62>\
**Category:** Administration\
**Tags:** access-grants\
**Created:** [May 10, 2024, 11:35pm UTC](https://community.omni.co/t/how-do-i-limit-access-to-columns-based-on-user-attributes-column-level-permissions/62 "2024-05-10T23:35:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![conner](https://yyz2.discourse-cdn.com/flex004/user_avatar/community.omni.co/conner/32/11_2.png) [@conner](https://community.omni.co/u/conner)\
**Post date:** [May 10, 2024, 11:35pm UTC](https://community.omni.co/t/how-do-i-limit-access-to-columns-based-on-user-attributes-column-level-permissions/62/1 "2024-05-10T23:35:56Z")

</div>

You may have some fields in a table that contain sensitive information, or you may want to limit them for another reason. In this article, I’ll:

1. Explain how to use Omni to limit access to those fields, and
2. Walk through a step-by-step example of this process.

# Overview of Column-level Permissions

You can set up **column-level permissions** through a combination of (1) user attributes, (2) access grants, and (3) access grant requirements on individual fields.

Here’s how those pieces fit together:

1. Users have [user attributes](https://docs.omni.co/administration/user-attributes/#user-attributes)
2. User attributes can be used to create [access grants](https://docs.omni.co/modeling/model-file#access_grants), which define a set of required values for certain user attributes in order for access to be granted
3. [Applying an _access grant_ to a field](https://docs.omni.co/modeling/dimensions/#required_access_grants) means that a user’s _user attributes_ must equal the allowed values in the access grant in order for the user to access that field

This is easier to digest through an example:

1. Imagine you’re an eCommerce company that collects PII (personal identifiable information) in the order checkout process. You don’t want everyone in your company to be able to see a customer’s PII — you only want people who have been ceritified by your security team to have access to this data.
2. You might set up a _user attribute_ called `security_certified` with values of TRUE or FALSE. Each user will have this user attribute denoting if they have been certified by security.
3. You can then create an _access grant_ called `can_see_pii`, which checks that `security_certified = TRUE` before granting access to a given field.
4. Then, you can apply the `can_see_pii` _access grant_ to a field, limiting access to users who meet the requirements for the `can_see_pii` access grant (which, in turn, means the user must have `security_certified = TRUE`).

Another way to think about this is that **access grants** let you easily apply the same sets of required user attributes to multiple fields without having to repeatedly define those requirements on each field.

# Step-by-Step Example

While this may sound complicated, setting up these controls is straightforward in practice. Let’s walk through an example from start to finish.

### Step 1: Creating user attributes

Start by navigating from your homepage \> Settings \> Attributes. Hit the “New Attribute” button and fill out the information. (Here’s our [documentation](https://docs.omni.co/administration/user-attributes/#user-attributes) for more on user attributes).

Once you’ve created a user attribute, you can assign values to each user in the Users tab.

 ![editing_user_attributes](https://canada1.discourse-cdn.com/flex004/uploads/omni/original/1X/52d9f47f3e6d91d3c7f2e72bd605f8d1317e7a59.png)

### Step 2: Defining your access grant

Open up your model file (you can do this in either your shared or workbook model) and navigate to the “Model” section. Follow the syntax below to add the definition for your new access grant. (Here’s our [documentation](https://docs.omni.co/modeling/model-file#access_grants) for more on access grants.)

The `allowed_values` are case-sensitive, so make sure your user attribute values match the case of your allowed values.

(_Note_: The `allowed_values` parameter behaves like an OR. As long as a user has a “test” user attribute value of val1 OR val2, they will pass the access grant.)

```auto
access_grants:
  testing_access_grant:
    user_attribute: "test"
    allowed_values: ["val1", "val2"]

```

### Step 3: Applying your access grant to a field/column

Navigate to the view file of the field you want to apply the access grant to. Follow the syntax below to add the `required_access_grants` parameter to your field definition, and list the names of the access grants you want to apply. (Here’s our [documentation](https://docs.omni.co/modeling/dimensions/#required_access_grants) for more on the `required_access_grants` parameter).

(_Note_: If you supply multiple `required_access_grant` values, they will behave like an AND. A user must meet the requirements for _every_ access grant listed in order to access the field.)

```auto

full_name:
  type: string
  required_access_grants: [testing_access_grant] -- [testing_access_grant1, testing_access_grant2] 

```

### Step 4: Testing your access grant

As an admin, you can use Omni’s “Impersonate User” functionality to test that your access grant is functioning properly. Impersonate a user with an user attribute value that excludes them from your access grant, and open up a new workbook to test that they can or can’t see the protected field.

 ![image](https://canada1.discourse-cdn.com/flex004/uploads/omni/original/1X/e91dab2d2438ac5804ba11470aa37569ed245ed3.png)

## Conclusion

It might take a bit of work to get started, but once you have these user attributes and access grants spun up, protecting important fields should only require a few lines of code. If you’re still having trouble, reach out to the Omni support team and we’d be happy to help.