Skip to main content

Configure access policies

Learn how to configure table, column, and row-level access policies on a Retool resource.

Configure access policies on a resource to control access to data that a group of users can read or write. You turn on enforcement, create a policy, and activate it, from the Access Enforcement tab of the resource.

Caution

Workflow queries are blocked on an enforced resource no matter which policies exist. This covers runs triggered by a schedule, a webhook, a query, an email, or another agent, and also manual and app-triggered runs unless your organization attributes them to the user who started them. Inventory the workflows querying a resource before you activate a policy. Refer to Use a separate resource for workflow queries for a way to keep them running.

Requirements​

  • An Enterprise plan.
  • A PostgreSQL resource. Access policies are supported only for PostgreSQL.
  • Own access to the resource. Users with Use or Edit access cannot view or configure policies.
  • On self-hosted deployments, access policies enabled for your organization. To enable, navigate to Settings > Beta and toggle on the feature flag for Enforce data security using access policies. Access policies are enabled by default on Retool Cloud.

1. Turn on data access enforcement​

Turning on data access enforcement closes the resource until an active policy grants access, so the first policy you create should cover the groups already using it. Refer to Data access enforcement for what the setting changes.

  1. Navigate to Resources and create a new PostgreSQL resource, or select one you have Own access to.
  2. Select the Access Enforcement tab.
  3. Toggle on Data access enforcement.
  4. Click Save changes.

A Controls on badge appears next to the name of the resource once data access enforcement is turned on.

Caution

The resource is closed to every user from the moment you save, including admins.

2. Create a policy​

To create an access policy, from the Access Enforcement tab:

  1. Select Create policy.
  2. Enter a name, and optionally a description. Both are visible to anyone with Own access to the resource.
  3. Under Policy assignment, add groups to Apply to. The policy grants access to every member of these groups.
  4. Optionally add groups to Except. Members of these groups are not subject to the policy, even if they also belong to a group named in Apply to.
  5. Select environments the policy covers. A policy must cover at least one.
  6. Under Policy rules, choose Full access to grant unrestricted access to the resource, or Granular access to define table, column, and row rules.
  7. Click Save draft to store the policy.

Refer to Access levels for the differences between Granular access and Full access.

Granular access​

With Granular access selected, the Tables pane lists the tables on the resource.

  1. Select one or more tables. Use the search field to filter long lists.
  2. Click Add rules to choose what the selected tables allow: Allow read access, Allow write access, or Allow read + write access.
  3. To restrict which columns a table exposes, select the table and add columns under Column access, or hover over each column in the table, and click Allow in the column header. To cover the whole table, choose All present + future columns, which also covers columns added later, or All present columns, which selects only the columns the table has now. A rule with no columns listed grants nothing, so a rule needs at least one column.
  4. To restrict which rows a table exposes, add filters under Row filters. Refer to Restrict rows with filters for more information.
  5. Click Save draft to store the policy.

Access policy grants are additive. With Full access, rules aren't evaluated.

3. Activate the policy​

A new policy grants nothing until you activate it. Activating takes two saves, one on the policy itself and one on the resource.

  1. After you save your draft, Retool returns you to the Access Enforcement tab, which lists every policy on the resource.
  2. From the Policies list, click Activate to put the policy in effect for the assigned groups and environments.
  3. Click Save changes.
  4. Confirm that existing apps or queries behave as expected.

Deactivate policies instead of deleting them so you can restore broad access if a group was missed.

Manage existing policies​

From the Policies list on the Access Enforcement tab you can:

  • Activate or deactivate a policy. Deactivating stops the policy from applying without deleting it.
  • Edit a policy's assignment, access level, or rules.
  • Delete a policy.
  • Select several policies to bulk Activate, Deactivate, or Delete.

Each of these actions takes effect once you click Save changes on the Access Enforcement tab. Editing a policy takes two saves as well: Save edits on the policy, and Save changes on the Access Enforcement tab.

Deactivating the only policy covering a group removes that group's access to the resource entirely. Turning data access enforcement off leaves every policy in place, deactivated rather than deleted.