Skip to main content

Permission Configuration When One User Belongs to Multiple User Groups

Scenario Description

User group permissions are configured in the dataset, but data outside the permission scope can still be seen in the card:

image.png

Cause

After testing, if a user is in a child user group and the child user group belongs to a parent user group, permissions from both user groups affect that user.

In this customer scenario, visible fields are determined by union. For example, the children's clothing all-channel user group can see direct sales, online, and distributor data. The children's clothing distributor user group is a child of the children's clothing all-channel user group. Even if its permission is set to see only distributor data, because the user belongs to the children's clothing distributor user group and that group belongs to the children's clothing all-channel user group, the user's visible permissions become direct sales, online, and distributor.

Solution

Split the children's clothing all-channel user group into three or more parent user groups, and set permissions for each group separately.

Alternatively, if there are many users and rebuilding user groups is inconvenient, create a parent user group with no permissions configured, move child user groups under that parent group, and then set corresponding permissions directly in each child user group.

Additional FAQ

Q: If a user belongs to both group A and group B, group A has permissions configured, and group B has no permissions configured, will data permissions take effect?

A: Yes. Permissions are combined by union.

Q: A dataset has five fields, and a user belongs to both user group A and user group B. User group A is configured to hide fields 1 and 2. User group B is configured to hide fields 2 and 3. Which fields can the user not see?

A: If user group A and user group B have a parent-child relationship, meaning one group belongs to the other, the user cannot see fields 1, 2, and 3. In other words, invisible fields are combined by union. If user group A and user group B have no relationship, the user cannot see field 2, while fields 1 and 3 are visible. In other words, invisible fields are combined by intersection.