---
schema_version: "1"
id: 5b4cd84590c35e7da608fd9556c7cbf3db25caa8810378fbad117060ed62ed20
title: Create an Object or Field-Level Access Policy in Data 360
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/data/264-0-0/c360_a_create_ols_fls_policy.md
canonical_url: https://help.salesforce.com/s/articleView?id=data.c360_a_create_ols_fls_policy.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: dd5fbfe414a67ce31a79d33875123c5774602f22a90095c0bd4c9cb74911e6dc
description: In data governance, define who can access specific data objects or fields based on user and data attributes. Create object-level or field-level access policies for users.
products:
  - Data 360
release: "264"
---
# Create an Object or Field-Level Access Policy in Data 360

In data governance, define who can access specific data objects or fields based on user and data attributes. Create object-level or field-level access policies for users.

### Required Editions

Before completing this task, review these considerations.

- Data 360 enforces service protection limits on Object-Level Security (OLS) and Field-Level Security (FLS) policies to prevent complex policies from affecting system performance. The impact depends on the number of rules and condition complexity. More complex policies have a greater impact.The system checks these limits when you create, edit, or delete a policy. You can't save a policy that exceeds the limit. Simplify the policy or consolidate existing ones.
- When OLS or FLS restrictions are applied to objects within a data graph, the graph is hidden from the list view to prevent unauthorized access. But this filtering doesn’t apply to draft data graphs, since their underlying objects, such as ID or Value DMO, haven’t been created yet. As a result, a draft data graph can still appear in the list view, but opening it displays an error.
- Data 360 architects or users with View All Records (VAR) Modify All Records (MAR) permissions can view the metadata of all objects, even if deny policies are in place. They can add fields, including those restricted by policies, to a report during creation or editing. However, access policies are enforced at runtime. If the Data 360 admin or user doesn’t have access to any of the fields included in the report, the report fails to run and displays an error.
- Index custom user fields before using them in policies for optimal performance.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All Editions</strong> supported by Data 360. See <a href="https://help.salesforce.com/s/articleView?id=data.c360_a_dc_editions.htm&amp;release=264.0.0&amp;type=5" title="Data 360 is available in several supported Salesforce editions. Some Data 360 features also require additional licenses.">Data 360 edition availability</a>.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:left;vertical-align:top;" id="d36842e84">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d36842e84 ">To create a data access policy:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d36842e84 ">
              <p>Permission set: </p>
              <ul>
                <li>Data Cloud Architect </li>

              </ul>
            </td>

          </tr>
        </tbody>
      </table>

1. In Data 360, go to the Data Governance tab.
2. In the left pane, click **Policies**.
3. Click **New**, select **Data Access**, and click **Next**.
4. In Policy Builder, enter a unique policy name, and an optional description.
    
    The policy API name is auto-filled based on your policy name, but you can change it.
5. Select the user authorization level. For more information, see [Controlling External User Access in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_control_external_user_access.htm&type=5&language=en_US).
6. Click **Next**.
7. Select **Rules**, and select the resources to protect. In the **Resource** dropdown, select **Object** or **Field**.
    
    By default, the rule applies across all data spaces. As new data spaces are added, these rules apply to their resources.
8. To restrict policies to specific data space scopes, click **Customize Scope**, deselect Apply to the resources in all Data Spaces in Data 360, and select the desired data spaces.
9. Click **Save**.
10. Select the action you want to take on the resource. From the Action dropdown, select **Allow access** or **Deny access**.
    
    Only Deny access is supported in a field-level security (FLS) policy.
11. Define the conditions when this action must take place. For example, set a condition to trigger the rule if the **Financial Data.Account Info** tag is present in the object. Or, if the **Personal Data.Digital Identifier.Browsing History** tag is not present in the object. Trigger the rule when objects meet any or all specified conditions.
12. To add more conditions, click **Add Condition**.
13. Group your conditions into different sets and use the OR operator to take action when any group meets the rule conditions.
14. To add a group, click **Add Group**.
15. To apply the policy to users, select **Users**.
    
    1. Apply the policy to all users or to users who meet specific AND and OR conditions. The conditions are based on custom permissions or standard user attributes assigned to users. Standard user attributes include:
        - Call Center ID
        - Company Name
        - Department
        - Division
        - Profile ID
        - Title
    2. Custom user fields are also supported, such as `Department__c` or `Region__c`.
    3. Related object fields are supported using relationship notation. For example, `AssignedBrands__r.BrandName__c` or `Departments__r.DepartmentCode__c`.
16. Click **Save and Activate**.