---
schema_version: "1"
id: e211476a43785be85ed052cd2fb51c8ff7798285cf01b91a07e32edf96ad5a1b
title: Row-Level Security Example Based on Record Ownership
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/sales_insights_record_ownership.md
canonical_url: https://help.salesforce.com/s/articleView?id=sales.sales_insights_record_ownership.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 0b75bc399b58082266d8dd38d2e206f49aa9f6a7215fcb9281e47f979d4c943c
description: This policy ensures that a user can only view records (for example, Opportunities) that they’re explicitly designated as the owner of.
products:
  - Sales Cloud
release: "264"
---
# Row-Level Security Example Based on Record Ownership

This policy ensures that a user can only view records (for example, Opportunities) that they’re explicitly designated as the owner of.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Sales with <strong>Agentforce 1 Edition</strong> or Agentforce for Sales Add-On license in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d9097e70">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d9097e70 ">To manage <span>Data 360</span>:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d9097e70 ">Data Cloud Architect</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d9097e70 ">To manage Sales Insights:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d9097e70 ">Sales Insights User permission set</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d9097e70 ">To use Sales Insights:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d9097e70 ">Tableau Next Limited Consumer</td>

          </tr>
        </tbody>
      </table>

1. Determine which data DMO to include in the policy. The policy must be applied to the primary DMO that contains the record ownership field.
    
    |  |  |
    | --- | --- |
    | DMO | ssot\_\_Opportunity\_\_dlm |
    | Description | The fact object containing sales opportunity details. |
    | Controlling Field (User Context) | ssot\_\_OwnerId\_\_c (Record Owner ID) |
2. Add Policy/Author
    
    1. Navigate to the Data Governance tab in Data 360 and create a new Data Policy.
    2. Set the Resource to Record.
    3. Select the DMO: ssot\_\_Opportunity\_\_dlm.
    4. Set the Action to Deny. (This is often used to override the default "Allow All" policy, or you can use an Allow policy that explicitly filters.).
    5. Define the Condition (the security predicate):
    6. Set the rule to Deny access to the record unless the record's owner matches the logged-in user.
        
        - **_Condition Logic:_** **_ssot\_\_Opportunity\_\_dlm.ssot\_\_OwnerId\_\_c Is Not Equal To $User.ssot\_\_Id\_\_c_**
    
    Interpretation: If the opportunity owner ID doesn’t match the logged-in user's ID, deny access to that record.