Salesforce Docs Portal

Create an Object or Field-Level Access Policy in Data 360

In data governance, define who can access specific data objects or fields based on user and data attributes. Create object-level or field-level access policies for users.

Required Editions

Before completing this task, review these considerations.

  • Data 360 enforces service protection limits on Object-Level Security (OLS) and Field-Level Security (FLS) policies to prevent complex policies from affecting system performance. The impact depends on the number of rules and condition complexity. More complex policies have a greater impact.The system checks these limits when you create, edit, or delete a policy. You can't save a policy that exceeds the limit. Simplify the policy or consolidate existing ones.
  • When OLS or FLS restrictions are applied to objects within a data graph, the graph is hidden from the list view to prevent unauthorized access. But this filtering doesn’t apply to draft data graphs, since their underlying objects, such as ID or Value DMO, haven’t been created yet. As a result, a draft data graph can still appear in the list view, but opening it displays an error.
  • Data 360 architects or users with View All Records (VAR) Modify All Records (MAR) permissions can view the metadata of all objects, even if deny policies are in place. They can add fields, including those restricted by policies, to a report during creation or editing. However, access policies are enforced at runtime. If the Data 360 admin or user doesn’t have access to any of the fields included in the report, the report fails to run and displays an error.
  • Index custom user fields before using them in policies for optimal performance.
Available in: All Editions supported by Data 360. See Data 360 edition availability.
User Permissions Needed
To create a data access policy:

Permission set:

  • Data Cloud Architect
  1. In Data 360, go to the Data Governance tab.
  2. In the left pane, click Policies.
  3. Click New, select Data Access, and click Next.
  4. In Policy Builder, enter a unique policy name, and an optional description.
    The policy API name is auto-filled based on your policy name, but you can change it.
  5. Select the user authorization level. For more information, see Controlling External User Access in Data 360.
  6. Click Next.
  7. Select Rules, and select the resources to protect. In the Resource dropdown, select Object or Field.

    By default, the rule applies across all data spaces. As new data spaces are added, these rules apply to their resources.

  8. To restrict policies to specific data space scopes, click Customize Scope, deselect Apply to the resources in all Data Spaces in Data 360, and select the desired data spaces.
  9. Click Save.
  10. Select the action you want to take on the resource. From the Action dropdown, select Allow access or Deny access.
    Only Deny access is supported in a field-level security (FLS) policy.
  11. Define the conditions when this action must take place. For example, set a condition to trigger the rule if the Financial Data.Account Info tag is present in the object. Or, if the Personal Data.Digital Identifier.Browsing History tag is not present in the object. Trigger the rule when objects meet any or all specified conditions.
  12. To add more conditions, click Add Condition.
  13. Group your conditions into different sets and use the OR operator to take action when any group meets the rule conditions.
  14. To add a group, click Add Group.
  15. To apply the policy to users, select Users.
    1. Apply the policy to all users or to users who meet specific AND and OR conditions. The conditions are based on custom permissions or standard user attributes assigned to users. Standard user attributes include:
      • Call Center ID
      • Company Name
      • Department
      • Division
      • Profile ID
      • Title
    2. Custom user fields are also supported, such as Department__c or Region__c.
    3. Related object fields are supported using relationship notation. For example, AssignedBrands__r.BrandName__c or Departments__r.DepartmentCode__c.
  16. Click Save and Activate.