Standard dataset permissions

Standard datasets permissions are the same as permissions in every other section in Spider Impact. Administrators give dataset permissions to a group, and then give that group permission to view organizations. If someone is in a group that can see an organization, they can see its datasets. If someone is in a group with the “Modify Standard Permission Datasets” permission and that group can see the organization, that user will be able to modify all datasets with standard permissions in that organization.

When you create a dataset, it defaults to using standard permissions. As you can see on the Datasets Edit tab, “everyone who can see this organization can see this dataset”.

Advanced dataset permissions

There are times, however, when you don’t want people to see all of a dataset’s records. For example, you may want to allow everyone who can see the organization to only be able to see records where the “Restricted” field value is “False”. Or you may want to limit a user to only see a subset of the records based on a “Region” field.

For these datasets you can turn on Advanced permissions. When advanced permissions is on, only the users and groups who have been given explicit permission to the dataset can see it.

The users and groups that you add in the Permissions panel will be able to see all records by default, and they will only be able to view data. You can click on the Edit button to change this.

Here we can give the user any of the permissions in the purple box, and they only apply to this dataset. You can also add a permissions filter by clicking the add button in the permission filters panel.

We’re going to add a filter for Sales Department = “Corporate”.

When we’re done, the dialog looks like this. Dale Peterson can administer the dataset, but he can only see records where sales department is corporate.

When Dale logs in, he’ll see a permission filter permanently applied to every screen that shows dataset data.

Permission filters also apply when another dataset reaches this one through a link. For example, a report total drawn from a linked dataset includes only the linked records that each person is allowed to see.

Giving each user their own records

Some datasets are owned one record at a time. For example, each auditor completes their own audits, or an import assigns each task to the person named on it. You could add a separate permission for each person, but a single “User ID Field” permission does the same thing for everyone.

With advanced permissions on, click “Add User, Group, or Rollup Tree Group...” and choose “User ID Field”. Then choose the field that holds the user ID of each record's owner. Every signed-in user can now reach the records that contain their own user ID in that field, and no others. When an import adds new records, the people named in them have access as soon as they log in.

Click the permission's edit button to choose what it allows. A User ID Field permission can grant “View Individual Records”, “View Records Tab”, and “Modify Individual Records”, but not modifying the dataset, its permissions, or its views. It has to be able to view records before it can modify them or show the Records tab.

A few things to keep in mind:

• The field must be a number or text field in this dataset. It can't be a calculated field or a data clusters field.
• You can add more than one User ID Field permission, one for each field that names an owner, such as an auditor and a reviewer.
• People whose only access comes from a User ID Field permission can't create a record that names someone else, and they can't change the field to hand one of their records to another person.
• Any broader access someone has to the dataset, like a group that can view all records, still applies. Give the people you want to restrict only the User ID Field permission.

Viewing without explicit advanced permissions

There are two notable exceptions to the rule that only users and groups who are explicitly granted access can see advanced permissions datasets.

First is the “Modify All Datasets” permission. This is unchecked by default and allows members of the group to modify all datasets that the group can see, regardless of whether advanced permissions is on.

Second, you can add a user named “Everyone” when advanced permissions is on. This allows anyone who can see the dataset to view its data, and by editing the Everyone user’s permissions, you can restrict the records they can see or assign actions that every user can do.

Auditing dataset permissions

The default view for advanced permissions is “By User or Group”. This allows you to see a list of everyone who can view the dataset, and you can edit their permission by clicking on the edit button on the right.

Instead of viewing permissions “by user or group”, you can also choose to view permissions “by permission filter”. This is helpful when auditing exactly what people can see within the dataset.

The default view is showing users and groups that have any permission filters at all. As you can see, there are two users and one group who have permission filters, which means they can’t see all of the dataset records. Just like on the “by user or group” view, you can click on the edit button on the right to see and edit their permission filters.

There’s also a list of users and groups who can view all records. It’s collapsed by default.

This gives us a good impression of what’s going on. There are two users or groups who can view everything, and there are three users or groups who can view only some records. We can take our permissions audit quite a bit further, though.

If we click the “Field” select, we can see all of the dataset’s fields that have a user or group’s permission filter applied to them. In this example, “Country” and “Sales Department” are the two fields with permission filters. We’ll choose Sales Department.

We now see that Dale Peterson has a “Sales Department is Corporate” permissions filter directly applied to him. We also see the collapsed “view all” section with the same two users who can view all records. That means there are three users in the software who can view corporate sales department records.

You can also quickly assign other users and groups permission to see Corporate sales records.

When we click the “Permission Filter” dropdown we see that users or groups also have permission filters for the sales department being retail.

By exploring your dataset permissions this way, you can quickly understand who has access to what, and you can ensure that only the correct users have access to sensitive data.