Apply CLS to your database

GoalCopy Anchor Link

Restrict which columns users can see based on identity context passed via authentication tokens — without creating separate dashboards per role.

---

PrerequisitesCopy Anchor Link

• A connected database containing columns you want to protect (e.g., salary, email, seller).
• An existing dashboard or chart that uses the target table.
• A valid API key to generate test tokens in the sandbox.

---

StepsCopy Anchor Link

1. Verify sensitive columnsCopy Anchor Link

• Navigate to the Databases tab and select the target Database and Table.
• Click Preview to confirm the columns you want to restrict (e.g., a salary column or a seller identifier).

2. Define custom token attributesCopy Anchor Link

• Navigate to Users and select the User model tab.
• Locate the Token Attributes menu under Custom Attributes.
• Click Add an attribute.
• Input a factual name (e.g., role) and select the data type (e.g., String).
• Click Save changes to register the attribute for use in authentication tokens.

3. Configure column-level rulesCopy Anchor Link

• Return to the Databases section and select your Database and Table.
• Click the Access rules tab.
• In the column-level section at the top of the page:
  • Empty state: choose all (every column visible) or none (no column visible) as the default catch-all.
  • Click Add column section to create a section for sensitive columns.
  • Select the columns to protect (e.g., salary).
  • Click Add condition and define when those columns should be visible — for example: included if [role] is equal to [HR].
  • The catch-all section at the bottom covers all other columns (and any columns added to the table later).

4. Enable and save CLSCopy Anchor Link

• Click Save to activate the security policy.
• Verify that the CLS enabled indicator appears next to the table name.
• You may repeat this configuration for additional tables that require the same column-level logic.

5. Validate the CLS policyCopy Anchor Link

• Within the table view, click Preview access rules in the top right corner.
• Enter a test value for your custom attribute (e.g., role = HR) and click Generate preview.
• Confirm that sensitive columns appear only when the condition is satisfied.
• Change the attribute value (e.g., role = Sales) and regenerate the preview to confirm those columns are hidden.

6. Generate a test token and embedCopy Anchor Link

• Navigate to Settings > Embed & access and scroll to the Token Generation Sandbox.
• Enter your API Key and assign a value to your custom attribute (e.g., role = HR).
• Click Generate Token.
• Use this token in your embedded component (e.g., <tc-dashboard auth-token="YOUR_TOKEN">) to confirm the column-scoped view in your host application.

---

ConclusionCopy Anchor Link

The database now enforces Column-Level Security based on the identity context passed via authentication tokens. Combine CLS with Row-Level Security (RLS) on the same table for full row-and-column isolation in multi-tenant environments.

For operator details and policy semantics, see Column-Level Security (CLS).