RLS Examples

Use this page to review practical Row-Level Security examples before you define your own policies.

Plan support

Data Security is available in Enterprise Cloud and Enterprise Plus plans. Existing Business plan customers keep access.

This page provides five diverse Row-Level Security examples. Each example includes:

• A description of the use case
• The session properties it requires
• The policy condition
• A rough table schema
• An example query before RLS
• The compiled query after applying session properties

---

1. Organization isolation (multi-tenant)

Ensures that each customer (organization) can only view their own data. This is the most common multi-tenant isolation scenario.

Session properties

• @user_org_id (string)

Condition

-- org_id is the column name in the table
-- @user_org_id is the session property name
org_id = @user_org_id

Table schema

orders(
  id INT,
  org_id STRING,
  amount NUMBER
)

Example query

SELECT * FROM orders;

Compiled query (with @user_org_id = 'org_123')

SELECT * FROM orders WHERE org_id = 'org_123';

---

2. Owner access

Restricts rows to those owned by the user. For example, sales reps only see deals they personally own.

Session properties

• @user_id (string)

Condition

-- owner_user_id is the column name in the table
-- @user_id is the session property name
owner_user_id = @user_id

Table schema

deals(
  id INT,
  owner_user_id STRING,
  value NUMBER
)

Example query

SELECT * FROM deals;

Compiled query (with @user_id = 'u_42')

SELECT * FROM deals WHERE owner_user_id = 'u_42';

---

3. Team membership access

Allows access if the user owns the row or belongs to a team that has access. Useful when teams share responsibility for certain data (e.g., a support ticket queue).

Session properties

• @team_ids (string) — comma-separated list of team IDs
• @user_id (string)

Condition

-- owner_user_id and team_id are the column names in the table
-- @user_id is the session property name
owner_user_id = @user_id
OR team_id IN (SELECT value FROM SPLIT(@team_ids, ','))

Table schema

tickets(
  id INT,
  owner_user_id STRING,
  team_id STRING,
  subject STRING
)

Example query

SELECT * FROM tickets;

Compiled query (with @user_id = 'u_42', @team_ids = 't1,t2')

SELECT * FROM tickets
WHERE owner_user_id = 'u_42'
   OR team_id IN (SELECT value FROM SPLIT('t1,t2', ','));

---

4. Region allow-list

Restricts access to rows belonging to specific regions. Common in global organizations where regional managers only see data for their assigned territories.

Session properties

• @region_ids (string) — comma-separated list of regions

Condition

-- region_id is the column name in the table
-- @region_ids is the session property name
region_id IN (SELECT value FROM SPLIT(@region_ids, ','))

Table schema

customers(
  id INT,
  name STRING,
  region_id STRING
)

Example query

SELECT * FROM customers;

Compiled query (with @region_ids = 'US,CA')

SELECT * FROM customers
WHERE region_id IN (SELECT value FROM SPLIT('US,CA', ','));

---

5. RBAC-driven access

Grants access based on assigned roles. Rows tagged with required_role are only visible if the user holds that role (e.g., finance data visible only to FINANCE_ANALYST).

Session properties

• @role_ids (string) — comma-separated list of role names

Condition

-- required_role is the column name in the table
-- @role_ids is the session property name
required_role IN (SELECT value FROM SPLIT(@role_ids, ','))

Table schema

reports(
  id INT,
  report_name STRING,
  required_role STRING
)

Example query

SELECT * FROM reports;

Compiled query (with @role_ids = 'FINANCE_ANALYST,HR_ADMIN')

SELECT * FROM reports
WHERE required_role IN (SELECT value FROM SPLIT('FINANCE_ANALYST,HR_ADMIN', ','));