---
schema_version: "1"
id: 70dc015048eb26c6611ee2989a5831d3f1191bbe5026914a3a37e79f6b617bf5
title: Determine Row-Level Security for the Dataset
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/analytics/264-0-0/bi_security_rowlevel_example_rolehierarchy_determinerls.md
canonical_url: https://help.salesforce.com/s/articleView?id=analytics.bi_security_rowlevel_example_rolehierarchy_determinerls.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b0c48a44a73c12a07ee570245a2399f7b0396a3205dfb2906eccf9a010977b96
description: Now it’s time to think about row-level security. How will you restrict access to each record in this dataset?
products:
  - CRM Analytics
  - Cross Cloud
release: "264"
---
# Determine Row-Level Security for the Dataset

Now it’s time to think about row-level security. How will you restrict access to each record in this dataset?

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in Salesforce Classic and Lightning Experience.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with CRM Analytics, which is available for an extra cost in <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions. Also available in <strong>Developer</strong> Edition.</td></tr></tbody></table>

You decide to implement the following predicate on the dataset.

```
'ParentRoleIDs' == "$User.UserRoleId" || 'OwnerId' == "$User.Id"
```

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/images/icon_note.png)

Note The current dataflow doesn’t contain logic to create a dataset column named “ParentRoleIDs.” ParentRoleIDs is a placeholder for the name of a column that will contain this information. In the [next step](https://help.salesforce.com/s/articleView?id=analytics.bi_security_rowlevel_example_rolehierarchy_addpredicate.htm&release=264.0.0&type=5 "Now it’s time to modify the dataflow definition file to account for the predicate."), you will modify the dataflow to add this column to the dataset. This column name will change based on how you configure the dataflow.

Based on the predicate, CRM Analytics returns an opportunity record if:

- The user who submits the query is a parent of the opportunity owner based on the Salesforce role hierarchy. CRM Analytics determines this based on their role IDs and the role hierarchy.
- Or, the user who submits the query on the dataset is the opportunity owner.

Let’s examine both parts of this predicate.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d155945e70">Predicate Part</th>
              <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d155945e72">Description</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="Predicate Part" class="slds-cell-wrap" style="vertical-align:top;" headers="d155945e70 ">'ParentRoleIDs' == "$User.UserRoleId"</td>
              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d155945e72 ">
                <ul>
                  <li dir="ltr">ParentRoleIDs refers to a dataset column that contains a comma-separated
                    list of role IDs of all users above the opportunity owner based on the role hierarchy.
                    You will create this dataset column in the next section.</li>
                  <li dir="ltr">$User.UserRoleId refers to the UserRoleId column of the User object. CRM
                    Analytics looks up the user role ID of the user who submits the query from the User
                    object.</li>
                </ul>
              </td>
            </tr>
            <tr class="">
              <td data-label="Predicate Part" class="slds-cell-wrap" style="vertical-align:top;" headers="d155945e70 ">'OwnerId' == "$User.Id"</td>
              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d155945e72 ">
                <ul>
                  <li dir="ltr">OwnerId refers to the dataset column that contains the user ID of the owner
                    of each opportunity.</li>
                  <li dir="ltr">$User.Id refers to the Id column of the User object. CRM Analytics looks up
                    the user ID of the user who submits the query from the User object.</li>
                </ul>
              </td>
            </tr>
          </tbody>
        </table>