---
schema_version: "1"
id: fd19a884c2abdf15e0ec71d7782963343e4efcf3d2df65e7370d44dd44dc02c7
title: Implement Data Governance Permissions for Agentforce Session Tracing Objects
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/ai/264-0-0/generative_ai_session_trace_data_governance.md
canonical_url: https://help.salesforce.com/s/articleView?id=ai.generative_ai_session_trace_data_governance.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 44892971de788e1cafdcca50458ed7ae226d017b2976835a7686d8003fbaa28d
description: Use Data Cloud Data Governance to protect sensitive data by setting up dynamic data masking and field-specific data exclusion policies. Grant access to the impacted Data 360 objects according to an access policy.
products:
  - Agentforce
  - Cross Cloud
release: "264"
---
# Implement Data Governance Permissions for Agentforce Session Tracing Objects

Use Data Cloud Data Governance to protect sensitive data by setting up dynamic data masking and field-specific data exclusion policies. Grant access to the impacted Data 360 objects according to an access policy.

## Permission Sets for Data Spaces

Apply permissions at the data space level. That way, only authorized users can view or query Agentforce Session Tracing data.

For permission set access tiers, see [Data 360 Standard Permission Sets](https://help.salesforce.com/s/articleView?id=data.c360_a_userpermissions.htm&language=en_US&type=5).

- On the `default` data space, users with the Data Cloud Architect (formerly the Data Cloud Admin) permission set have access to all the data (by default). The Data Cloud Architect can grant data access to users with the Data Cloud User permission set. To define the scope for data space access, see the instructions in [Assign a Data Space Permission Set to a Data Cloud User](https://help.salesforce.com/s/articleView?id=data.c360_a_assign_permission_set.htm&language=en_US&type=5).
- On a custom data space, only users with the Data Cloud Architect permission set have access to all the data.

## Access Policy Options

You can select from either attribute-based access control (ABAC) or role-based access control (RBAC). Access control provides granular control over your users' access to data. Follow instructions in [Assign Data Access](http://sfdc.co/dc-objects) to assign these objects to an available policy.

## Impacted Data 360 Objects

For a list of impacted Data 360 objects, see [Data Model for Agentforce Session Tracing](https://help.salesforce.com/s/articleView?id=ai.generative_ai_session_trace_data_model.htm&release=264.0.0&type=5 "Use the data model in Data 360 to build reports, dashboards, and queries that provide insights into agent behavior. The system streams data to data lake objects (DLOs) in Data 360 within minutes. Access the data via the standard data model objects (DMOs), which are mapped to the DLOs.").

If you have more than one data space, grant access to objects in each data space. Object names in non-default data spaces follow the convention of `<DataSpace Prefix>_<Object Name>`.

## Test Your Access Policies

After you've updated permissions, be sure to test user access to collected Agentforce Session Tracing data.

#### See Also

- [Data Governance in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_data_gov_capabilities.htm&language=en_US)