Data Gates

Data Gates are Celiq's field-level security system. They let you control which users or roles can see and query specific fields — useful for protecting PII, sensitive financial data, or any column that should not be universally accessible.

You define a Data Gate once in your semantic model, then grant or deny access by role. Celiq enforces the gate automatically on every Reveal, Scene, and Mosaic tile.

How Data Gates work

1. Mark the field in CML — inside a node file in Forge, add a data_gate property to any dimension or measure.
2. Grant or deny per role — a Luminary opens the Admin Console and configures which roles can access the gated field.
3. Celiq enforces it in Discover — users who have access see the field and can query it. Users without access see a restricted indicator or the field is hidden entirely.

Defining a Data Gate in CML

Add the data_gate property to any dimension or measure in a node file:

node: customers
  sql_table: analytics.customers

  dimension: customer_id
    type: string
    sql: ${TABLE}.customer_id

  dimension: email
    type: string
    sql: ${TABLE}.email
    data_gate: pii_access
    description: "Customer email address — gated as PII"

  dimension: full_name
    type: string
    sql: ${TABLE}.full_name
    data_gate: pii_access

  measure: lifetime_value
    type: sum
    sql: ${TABLE}.ltv
    data_gate: financial_access

• pii_access and financial_access are gate names. You can use any string. The same gate name can appear on multiple fields — all fields with the same gate name are controlled together in Admin Console.
• A single field can have only one Data Gate.

Granting and denying access by role

1. Open Admin Console — A Luminary opens Admin Console → Data Gates.
2. Find the gate by name — Locate the gate (e.g. pii_access) and click Manage access.
3. Toggle access per role — For each role, toggle access on or off. Click Save.

Effect on each role in Discover

Applying a Data Gate to a measure

Data Gates work on measures as well as dimensions. If a measure is gated and a user without access includes it in a Reveal, the query is blocked and an error message explains that the field is not available for their role.

Data Gates vs. Data Keys

You can combine Data Gates and Data Keys on the same node. Celiq applies both independently — a user must satisfy the row filter (Data Key) and have field-level access (Data Gate) to see a value.

Frequently asked questions

Not directly. Data Gates are role-based. To grant access to a single user, assign that user a role that has the gate granted, or ask your Luminary to create a dedicated role for that person.

Yes. When Celiq runs a scheduled Scene or Mosaic delivery, it applies the permissions of the user who set up the schedule. If that user's role does not have access to a gated field, the field is excluded from the delivery.

The Tracer can open the Scene, but when the query runs, the gated field shows the Restricted badge in the results. The Tracer does not see the underlying data.

Yes. If you gate a field that is also used as a join key, users without access cannot join on it from Discover. The join is still available in the semantic model for internal use.