Set Up Dataset Security to Control Access to Rows

If a CRM Analytics user has access to a dataset, the user has access to all records in the dataset by default. To restrict access to records, you can implement row-level security on a dataset when you use sharing inheritance and security predicates. Sharing inheritance automatically applies a Salesforce object’s sharing logic to the dataset’s rows. A security predicate is a manually assigned filter condition that defines dataset row access.

To implement effective dataset row-level security, most Salesforce orgs can use a combination of sharing inheritance and a backup security predicate. Sharing inheritance provides the correct record access to your users who do not have many employees or shared records. For users with access to many of their own or shared records, like a CEO or dashboard builder, a security predicate is set as backup to sharing inheritance.

To get started, learn more about sharing inheritance and security predicates. Then turn on sharing inheritance and evaluate how well sharing inheritance covers your users’ dataset access needs. Finally, set the dataset’s security predicate if needed and test.

• Add Row-Level Security with a Security Predicate
  Applying a predicate to a dataset is more than just defining the predicate expression. You must also consider how the predicate is dependent on the information in the dataset and where to define the predicate expression.
• Add Row-Level Security by Inheriting Sharing Rules
  Use sharing inheritance to let CRM Analytics apply the same sharing setup for your datasets as Salesforce uses for your objects. Sharing inheritance increases access accuracy and reduces the need for complicated security predicates for most objects and situations. The tradeoff for applying sharing inheritance is an increase in the time to complete data syncs, dataflow and recipe jobs, and queries. The more complicated the sharing settings, the more impact there is.