---
schema_version: "1"
id: 7487455ace66475934b3856766ffe00ce16ce0fb87133300b8dd3ac501425018
title: Set Up Dataset Security to Control Access to Rows
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/analytics/264-0-0/bi_security_datasets_row_level.md
canonical_url: https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_row_level.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 060ad3229496f5ecf4d85af9a66d6e14ec9f343858bcfb15a32bf68a5290e60c
description: If a CRM Analytics user has access to a dataset, the user has access to all records in the dataset by default. To restrict access to records, you can implement row-level security on a dataset when you use sharing inheritance and security predicates. Sharing inheritance automatically applies a Salesforce object’s sharing logic to the dataset’s rows. A security predicate is a manually assigned filter condition that defines dataset row access.
products:
  - CRM Analytics
  - Cross Cloud
release: "264"
---
# Set Up Dataset Security to Control Access to Rows

If a CRM Analytics user has access to a dataset, the user has access to all records in the dataset by default. To restrict access to records, you can implement row-level security on a dataset when you use sharing inheritance and security predicates. Sharing inheritance automatically applies a Salesforce object’s sharing logic to the dataset’s rows. A security predicate is a manually assigned filter condition that defines dataset row access.

To implement effective dataset row-level security, most Salesforce orgs can use a combination of sharing inheritance and a backup security predicate. Sharing inheritance provides the correct record access to your users who do not have many employees or shared records. For users with access to many of their own or shared records, like a CEO or dashboard builder, a security predicate is set as backup to sharing inheritance.

To get started, learn more about [sharing inheritance](https://help.salesforce.com/articleView?id=bi_security_datasets_sharing_about.htm&type=5&language=en_US) and [security predicates](https://help.salesforce.com/articleView?id=bi_security_datasets_predicate_considerations.htm&type=5&language=en_US). Then [turn on](https://help.salesforce.com/articleView?id=bi_security_datasets_sharing_getting_started.htm&type=5&language=en_US) sharing inheritance and [evaluate how well](https://help.salesforce.com/articleView?id=bi_security_datasets_sharing_determine_will_work.htm&type=5&language=en_US) sharing inheritance covers your users’ dataset access needs. Finally, set the [dataset’s security predicate](https://help.salesforce.com/articleView?id=bi_security_datasets_predicate_syntax.htm&type=5&language=en_US) if needed and test.

- **[Add Row-Level Security with a Security Predicate](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_considerations.htm&release=264.0.0&type=5)**  
    Applying a predicate to a dataset is more than just defining the predicate expression. You must also consider how the predicate depends on the information in the dataset and where to define the predicate expression.
- **[Add Row-Level Security by Inheriting Sharing Rules](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_about.htm&release=264.0.0&type=5)**  
    Use sharing inheritance to let CRM Analytics apply the same sharing setup for your datasets as Salesforce uses for your objects. Sharing inheritance increases access accuracy and reduces the need for complicated security predicates for most objects and situations. The tradeoff for applying sharing inheritance is an increase in the time to complete data syncs, dataflow and recipe jobs, and queries. The more complicated the sharing settings, the more impact there is.

#### See Also

- [sfdcRegister Transformation](https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_register_transformation.htm&release=264.0.0&type=5 "The sfdcRegister transformation registers a dataset to make it available for queries. Users can’t view or run queries against an unregistered dataset.")
- [sfdcRegister Parameters](https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_register_transformation_operation.htm&release=264.0.0&type=5 "When you define an sfdcRegister transformation, you set the action attribute to sfdcRegister and specify the parameters.")