# Apply RLS to your database (/core/embed/permissions-and-row-level-security/how-to/apply-rls-to-your-database)









<CalloutContainer type="info">
  <CalloutDescription>
    **Target Audience**: Developers & Non technical users
  </CalloutDescription>
</CalloutContainer>

### Goal [#goal]

Establish a secure mapping between dynamic user attributes and dataset fields to filter data at query time.

***

### Prerequisites [#prerequisites]

* A [connected database](/core/build/data-connections/how-to/add-a-database) containing columns suitable for filtering (e.g., `region`, `team_id`, `department`).
* An [existing dashboard](/core/build/dashboards-and-layouts/how-to/create-a-dashboard-with-ai) or [chart](/core/build/charts/how-to/create-a-chart) to validate the filtering logic.
* A [valid API key](/core/embed/authentication/how-to/generate-an-api-key) to generate test tokens in the sandbox.

***

### Steps [#steps]

#### 1. Verify dataset compatibility [#1-verify-dataset-compatibility]

* Navigate to the **Databases** tab and select the target **Database** and **Table**.
* Click **Preview** to confirm the presence of the column intended for filtering (e.g., a `location` column containing values like "Paris" or "Tokyo").

#### 2. Define custom token attributes [#2-define-custom-token-attributes]

* Navigate to the **Settings** tab and select the **Embed & access** section.
* Locate the **Token Attributes** menu under **Custom Attributes**.
* Click **Add an attribute**.
* Input a factual **name** (e.g., `location`) and select the **data type** (e.g., `String`).
* Click **Save changes** to register the attribute for use in authentication tokens.

<img alt="Custom attributes" src="__img0" />

#### 3. Map attributes to database columns [#3-map-attributes-to-database-columns]

* Return to the **Databases** section and select your **Database** and **Table**.
* Click the **Access rules** tab to configure security policies.
* Under the section "Then, for a row to be included...", use the rule builder to define your filter.
* In the **Select dataset field** dropdown, choose the column in your database you want to filter (e.g., `location_name`).
* Ensure the operator is set to **must be equal** to.
* In the **Select token attribute** dropdown, select the custom attribute created in Step 2 (e.g., `location`).

<img alt="RLS settings" src="__img1" />

#### 4. Enable and save RLS [#4-enable-and-save-rls]

* Click Save to activate the security policy.
* Verify that the RLS enabled blue tag appears next to the table name.
* You may repeat this mapping for additional tables that require the same security logic.

#### 5. Validate the RLS policy [#5-validate-the-rls-policy]

* Within the table view, click **Preview with Token** in the top right corner.
* Enter a test value for your custom attribute (e.g., `Paris`) and click **Generate Preview**.
* Confirm that the displayed data rows are strictly limited to the value provided.

<img alt="Preview RLS" src="__img2" />

#### 6. Generate a test token and embed [#6-generate-a-test-token-and-embed]

* Navigate to **Settings > Embed & access** and scroll to the **Token Generation Sandbox**.
* Enter your **API Key** and assign a value to your custom attribute (e.g., `location` = `Paris`).
* Click **Generate Token**.
* Use this token in your embedded component (e.g., `<tc-dashboard auth-token="YOUR_TOKEN">`) to confirm the filtered view in your host application.

***

### Conclusion [#conclusion]

The database now enforces Row-Level Security based on the identity context passed via authentication tokens. This ensures data isolation in multi-tenant environments without the need for multiple dashboards.

To restrict which columns users can see on the same table, see [Apply CLS to your database](/core/embed/permissions-and-row-level-security/how-to/apply-cls-to-your-database).