Data Keys (RLS)

Data Keys are Celiq's row-level security system. They let you ensure that each user or role only sees the rows of data they are allowed to see — without writing separate queries or maintaining duplicate datasets.

Once you define a Data Key in your semantic model and assign values to users in the Admin Console, every query that touches that node is filtered automatically. Users never see the filter and cannot remove it.

Warning: Users with no assignment for a Data Key see zero rows by default. Celiq is fail-closed — if you forget to assign someone, they get nothing, not everything. Assign * to give a user unrestricted access to all rows.

How Data Keys work

There are three steps:

1. Define the key in CML — declare the Data Key inside a node file in Forge, telling Celiq which field it applies to.
2. Assign values in Admin Console — a Luminary assigns a value (or list of values) to each user or role.
3. Celiq applies it automatically — every Reveal, Scene, and Mosaic tile that queries that node has the filter injected before the query runs. The user sees only their rows.

Defining a Data Key in CML

Inside a node file in Forge, add a data_key block:

node: orders
  sql_table: analytics.orders

  data_key:
    name: region_access
    field: region
    description: "Limits rows to the user's assigned region(s)"

  dimension: region
    type: string
    sql: ${TABLE}.region

  dimension: order_id
    type: string
    sql: ${TABLE}.order_id

  measure: total_revenue
    type: sum
    sql: ${TABLE}.revenue

• name is how the key appears in the Admin Console.
• field is the dimension within this node that the key filters on. It must be declared as a dimension in the same node.

You can define multiple Data Keys on the same node if you need to filter on more than one field independently.

Assigning values in Admin Console

1. Open Admin Console — A Luminary opens Admin Console → Data Keys.
2. Find the key by name — Locate the key (e.g. region_access) and click Manage assignments.
3. Assign values per user or role — For each user or role, enter the value(s) they are allowed to see. Values are strings that must match what appears in the filtered column. Assign multiple values by separating them with commas — e.g. EMEA,APAC.

Wildcard — all rows

Assign * (a single asterisk) to give a user or role access to all rows:

User: alice@example.com
Value: *

Alice sees all rows, regardless of what the region column contains. Use this for Luminaries and senior analysts who need an unrestricted view.

Empty — no rows

Leave the assignment blank to give a user access to no rows. The query runs but returns zero results. This is useful for temporarily revoking access without removing the user from the workspace.

What users see

Users are never told they have a Data Key applied. In Discover, the Reveal appears to return all results for the query they ran — it just happens that the result set is already scoped to their rows. The filter does not appear in the filter bar.

If a user has no value assigned for a Data Key on a node they query, Celiq defaults to returning no rows (fail-closed) and shows an error message explaining that access has not been configured.

Multi-value and role inheritance

If a user belongs to multiple roles with different Data Key values, Celiq unions the values. If a user's role is assigned ["EMEA", "APAC"] and their personal assignment is ["AMER"], they see rows where region is EMEA, APAC, or AMER.

User-level assignments always override role-level assignments in a conflict.

Data Keys vs. Looker user_attributes

Data Keys are defined entirely in code, meaning they go through your normal Forge → Draft → PR → Live deployment workflow. Changes to Data Key definitions are reviewed before they reach production.

Frequently asked questions

No. Data Keys filter on dimension fields only.

No. Data Keys are scoped to the node they are defined on. Define a Data Key on each relevant node if you need RLS across multiple tables.

Celiq unions the values. The user sees all rows that match any of their assigned values.