Skip to main content

Grant broad access and restrict with exceptions

Give groups broad access to a resource and restrict access with exceptions.

A resource with data access enforcement turned on is closed by default, so a user can access only what an access policy grants them. When most groups should keep the access they already have and only a few need restricting, you can grant broad access to everyone with a single policy, then exclude the groups you want to restrict.

This is also the least disruptive way to adopt data access enforcement on a resource already in use, because no group loses access until you choose to restrict it.

Why exceptions are required​

Access policy grants are additive, so a narrow policy cannot subtract from a broad one. If a policy grants a group access to a table, adding a second policy that filters the same table for that group changes nothing.

The Except list is what removes a group from a policy. Refer to Multiple access policies for how grants combine.

Caution

A group you leave out of Except, including any group created later, receives the broad access the policy grants.

Requirements​

  • An Enterprise plan.
  • A PostgreSQL resource. Access policies are supported only for PostgreSQL.
  • Own access to the resource.

1. Create a broad access policy​

A broad access policy grants the access every group starts with.

  1. Turn on data access enforcement for the resource and select Create policy.
  2. Give the policy a name that identifies its scope, such as Broad access.
  3. Under Policy assignment, add All Users to Apply to.
  4. Choose Full access, to grant unrestricted access to the resource. This is the closest match to how the resource behaved before data access enforcement was turned on.
  5. Select environments the policy covers.
  6. Click Save draft.
  7. Then click Activate and select Save changes on the Access Enforcement tab.

Refer to Configure access policies for detailed information on how to create a full access policy. Confirm that existing apps and queries still behave as expected before continuing.

2. Create a policy for the group you want to restrict​

Create the restricted group's access before you take the broad access away, so the group is never left without a policy.

  1. Create a second policy, named for the group it covers.
  2. Add that group to Apply to.
  3. Choose Granular access and add the rules the group should be limited to. Refer to Restrict rows with filters to filter rows.
  4. Select the same environments as the broad policy you created in step 1.
  5. Click Save draft.
  6. Then click Activate and select Save changes on the Access Enforcement tab.

The group's access does not narrow yet. Both policies apply to them, and the broad policy still decides what they can access.

3. Add the restricted group to the broad policy's exceptions list​

The group's access narrows at this point.

  1. Open the broad policy you created in step 1.
  2. Under Policy assignment, add the group to Except.
  3. Click Save edits.
  4. Then select Save changes on the Access Enforcement tab.

Only the policy from step 2 applies to them now.

Except applies only to the policy you set it on. Adding a group to Except on the broad policy does not remove it from any other policy, so the group keeps whatever other active policies grant it. A user who belongs to both All Users and a group named in Except is restricted, because Except takes precedence over Apply to within the same policy.

Repeat steps 2 and 3 for each group you want to restrict.

4. Verify the exceptions applied​

List the users the broad policy applies to and confirm that members of an excluded group are absent using the Retool API:

GET /data_security_policies/{policyId}/users

The response omits members of an excluded group even though they belong to All Users. Refer to API endpoints for more information.