How RLS works in practice?

Digitization is bringing ever more sensitive data into user databases. The safest option is to move them to the Cloud, which is usually often more secure than environments with their own servers or even workstations.

At the same time, the Cloud has its own security requirements, because it is necessary to define precisely who, i.e. which company or which user in a company, has access to what. Security is exactly what PANTHEON 11 promotes.

PANTHEON has already ensured data security by implementing permissions. These remain unchanged and can be used to set access levels in a familiar way. Only the implementation of data security has changed.

We have developed advanced Row Level Security (RLS), which is configured with existing permissions.

All existing security mechanisms have been transferred from the user interface to table security. If you were previously able to read all accounts from a table with an SQL query, this will now no longer be possible. Every SQL query will be subject to the RLS protection mechanism. Only those rows that the user has access to will be read.

Let us look at two examples of how RLS works in PANTHEON.

1. RLS and PANTHEON

Users RLS1 and RLS2 both have full permissions:

User RLS2's permission to view costs is removed.

The RLS security mechanism limits the user RLS2's access at line level and only returns records that the user RLS2 has access to.

This applies to all PANTHEON modules, including Workflow and ARES, as well as all external applications that connect to the PANTHEON database.

2. RLS and EXCEL (EXTERNAL APPLICATION)

Below is a description of how the RLS works if data is accessed using an external application, for example Excel.

Users RLS1 and RLS2 access the PANTHEON database using their own domain accounts.

User RLS2's access to view costs is removed using PANTHEON permissions:

Then, refresh data from the Excel database:

You can see that even with external links, the same results are obtained as with PANTHEON.