Common Row-Level Security Examples

Row-level security allows you to tailor data visibility for different teams by applying filter expressions to individual tables. The following examples demonstrate common permission models used in sales, finance, multi-company environments, and analytics.

Use Case 1: Territory-Based Sales Access

Allow sales representatives to view customers only within their assigned territory.

Configuration

1. Create a team such as Sales Team North.
2. Add the appropriate sales representatives.
3. Grant access to the customers table.
4. Apply the following table restriction:

territory == 'North'

Result: Team members only see customer records where the territory is North.

Use Case 2: Individual Sales Representative Access

Allow each sales representative to view only their assigned customers and sales orders.

Configuration

1. Create a team named Sales Representatives.
2. Add all sales representatives to the team.
3. Grant access to the customers and sales_orders tables.
4. Apply the following filter to both tables:

sales_person == frappe.session.user

Result: Each user only sees records assigned to their own account.

Use Case 3: Sales Manager Access

Allow managers to view data belonging to everyone within their team or region.

Option 1: Region-Based Access

sales_person_region == 'West'

Option 2: Manager-Based Access

manager == frappe.session.user

Result: Managers can access records belonging to all members of their assigned region or reporting hierarchy.

Use Case 4: Accounts Receivable Team

Allow the Accounts Receivable team to work only with active customers that have outstanding invoices.

Customers Table

status == 'Active' AND outstanding_amount > 0

Sales Invoices Table

status != 'Paid' AND due_date IS NOT NULL

Result: The Accounts Receivable team only sees unpaid invoices belonging to active customers.

Use Case 5: Multi-Company Access

Restrict users so they can only access data for their assigned company or business unit.

Configuration

1. Create separate teams for each company.
2. Grant access to the required shared tables.
3. Apply a company filter to each team.

company == 'Company A'

Result: Members of each company team can view only records belonging to their own company.

Use Case 6: Time-Based Data Access

Limit users to viewing only recent transactions while hiding older historical data.

Configuration

transaction_date >= '2024-01-01'

Result: Users can access only records created on or after the specified date.