GabFernandes
Contributor

Hi @pragya17,

Yes, this is absolutely possible! Databricks AI/BI Dashboards support Row-Level Security (RLS) natively through Unity Catalog Row Filters — no dashboard-level configuration needed.

How it works:

Create a mapping table defining who can see what:

CREATE TABLE hr.security.manager_access (
  manager_email STRING,
  employee_id  STRING
);
-- Managers have rows for ALL their reports; employees have only their own row

Create a row filter function using CURRENT_USER():

CREATE FUNCTION hr.security.performance_filter(emp_id STRING)
RETURN
  -- Managers: see all employees under them
  EXISTS (
    SELECT 1 FROM hr.security.manager_access m
    WHERE m.manager_email = CURRENT_USER()
      AND m.employee_id = emp_id
  )
  OR
  -- Employees: see only their own record
  emp_id = CURRENT_USER();

Apply the filter to your table:

ALTER TABLE hr.gold.employee_performance
SET ROW FILTER hr.security.performance_filter ON (employee_id);

Publish the dashboard with "Individual data permissions" (not "Shared"). This ensures each viewer's identity is used to evaluate the row filter.

Key points:

  • CURRENT_USER() and IS_ACCOUNT_GROUP_MEMBER() are evaluated per viewer automatically
  • If you publish with Shared data permissions, all viewers see the publisher's data (RLS is bypassed)
  • You can also use IS_ACCOUNT_GROUP_MEMBER('managers') for group-based logic instead of a mapping table
  • No changes needed in the dashboard queries themselves — filtering is transparent at the data layer

If my answer was helpful, please consider marking it as accepted solution!

View solution in original post