Data entitlements
Grant teams access to specific data sources and understand how tenant and team isolation is enforced by Postgres row-level security.
Data entitlements decide which data sources a team can query. Together with organization-level isolation, they ensure people only reach the data they are meant to. This is an admin-only capability.
#Entitling a team to a source
An admin grants a team access to a data source from the team's settings. Two source types are supported:
| Source type | What it grants |
|---|---|
semantic_project |
Access to a semantic model project. You can optionally scope the grant to specific model names. |
connection |
Access to a warehouse connection. |
A team can only query models and connections it has been entitled to. Revoking a grant removes that access immediately.
#Isolation with Postgres row-level security
Flax enforces isolation in the database itself using Postgres row-level security (RLS), not just in application code:
- Tenant isolation. Every row carries its organization, and RLS policies restrict each request to its own organization's rows. Data from one organization can never be read from another.
- Team scoping. Access to team-owned content and entitlements is evaluated against the caller's team membership within the same tenant.
Because these checks live in Postgres, they apply uniformly to every query path — the app, the API, scheduled deliveries, and embeds — so there is no surface where they can be bypassed.
#Row-level filtering of query results
Entitlements decide whether a team can query a source. To filter which rows individual users see within a source — for example, restricting a regional manager to their region — combine entitlements with row-access filters driven by user attributes.