Manage row filters

September 21, 2026

In Data Access, a row filter is a type of access control that hides all rows in specific tables or views from everyone except its beneficiaries. The beneficiaries see only the rows that meet the filter criteria that are defined in the row filter.

You can create a row filter to restrict the visibility of rows in specific tables or views. If you create a row filter, users who already have access on the table or view can no longer see any of its rows, unless you add them as beneficiaries.

Prerequisites

• You own the table or view whose rows you want to hide.
• To create a row filter: You have a global role with the Data Access > Create Access Controls global permission, or you own any data object.
• To edit a row filter: You have a global role with the Data Access > Create Access Controls global permission, or you own the row filter or all of its data objects.

Steps

1. On the Data Access landing page, in the left pane, click ACCESS CONTROLS > Row filters.
2. Do one of the following:
   •  To create a row filter: Click Create row filter. On the Create row filter page, enter the information, and then click Create.
   • To edit a row filter: Click the name of the row filter, and then click Edit. Edit the information, and then click Save.

Result

• You become the owner of the row filter that you created. You can add more owners by clicking in the Owners field in the Details sidebar.
• Data Access automatically triggers a synchronization to push the row filter to the target data source. Until the row filter is created or updated in the data source, the Sync status field in the Details sidebar shows Not connected (for a new row filter) or Out of sync (for an edited row filter). After the synchronization finishes, the synchronization status changes to Synced.

Guidance: Defining a row filter

Use this section to guide you when creating or editing a row filter. If the row filter was already created, on the row filter page, click Edit, and then complete the following sections.

General

Specify the basic properties of the row filter in the General section.

Field	Description
Name	A unique display name for the row filter, for example, Customer Consent.
Description	A brief explanation of the row filter's purpose, for example, Hides customer records lacking active consent.

Filtered tables

Specify the tables or views whose rows you want to hide in the Filtered tables section.

1. In the Which tables are filtered section, click Add.
2. In the Where does this row filter apply dialog box, select the data sources for the row filter, and then click Continue. Note that you cannot change the data sources later. This step is applicable only when you create a row filter (not when you edit a row filter).
   
3. In the How do you want to pick tables to filter dialog box, select one of the following options, and then click Continue.

   Option	Description
   Data objects	Hides the rows in the tables or views that you specify.
   Dynamic rule	Hides the rows in the tables or views that meet the conditions that you specify.

4. If you selected Data objects, in the Select the tables you want to filter dialog box, select the tables or views that contain the rows that you want to hide, and then click Add.
5. If you selected Dynamic rule, in the Which schema do you want to filter dialog box, select the schemas within which you want the rows to be hidden, and then click Add.
   

Guidance: Defining a filter rule

Use this section to guide you when creating or editing a filter rule in a row filter. You can define a filter rule only after you create the row filter.

To create or edit a filter rule, on the row filter page, in the Filter rules section, click Add (to create) or next to the filter rule (to edit), and then complete the following sections.

General

In the General section, specify the basic properties of the filter rule.

Field	Description
Name	A unique display name for the filter rule, for example, Active Marketing Consent.
Description	A brief explanation of the filter rule's purpose, for example, Shows customer records having active marketing consent.

Filter criteria

In the Filter criteria > Which rows can be accessed section, specify the criteria that determine which rows to show to the beneficiaries. Rows that meet the filter criteria are called filtered rows.

Field	Description
Column	The column that you want to evaluate to determine if a row is shown to the beneficiaries, for example, a Marketing Consent column. If the row filter applies to multiple tables or views, the Column field shows a drop-down list of the columns that are common to all of them. You can also enter a column name manually if it does not appear in every selected table or view. Warning If a filter rule references a column that is missing from a filtered table or view, Data Access reports an error on the Issues page. The impact on that table or view in the meantime depends on your data source. Databricks and Snowflake: All filter rules for a table or view are combined into a single policy. If the table or view had no filter applied yet, the missing column reference prevents that policy from being created at all, so it remains fully unfiltered and anyone with access can see all of its rows. If the table or view already had a working filter policy from a previous synchronization, that existing policy stays in place and continues to be enforced. The invalid rule blocks the update, not the previously applied filtering. BigQuery: Each filter rule is applied as its own separate policy. A missing column reference affects only the one rule with the error; other rules on the same table or view continue to apply normally.
Operator	The operator that defines the condition between the column and the target value.
Value	The value that the column data must match for the row to be shown to the beneficiaries, for example, Active. For security reasons, Data Access does not import actual column values from your data sources. Due to this, you need to manually enter the exact value into this field (as it appears in your target table or view).

Beneficiaries

In the Beneficiaries section, specify the identities who can see the rows that meet the filter criteria. You can also specify groups and other roles.

1. In the Who has access to the filtered rows section, click Add.
2. In the Which type of beneficiary do you want to add dialog box, select one of the following options, and then click Continue.

   Option	Description
   Identities	Shows only filtered rows to the identities that you specify, if they have access on the table or view containing the rows.
   Groups	Shows only filtered rows to the identities within the groups that you specify, if they have access on the table or view containing the rows.
   Dynamic rule	Shows only filtered rows to the identities that meet the conditions that you specify, if they have access on the table or view containing the rows.
   Roles	Shows only filtered rows to the beneficiaries of the roles that you specify, if they have access on the table or view containing the rows, but only through the specified roles. That is, if the same beneficiaries have access on the table or view through any other role, they see zero rows.

3. If you selected Identities, Groups, or Roles, select one or more identities, groups, or roles, and then click Add.
4. If you selected Dynamic rule, in the Which conditions should apply dialog box, enter the required information, and then click Add.
5. To change the expiration date (which indicates when access is revoked) for the beneficiaries:
   1. In the Expires at column, double-click the current value.
      
   2. In the Edit expires at dialog box, select the new expiration date, and then click Apply.

Related topics

• Row filters
• How access controls sync
• Inheritance in access controls
• Deactivate or delete access controls