How Security is Applied to Dashboards of Salesforce Analytics Cloud?

02.23.15 By


Looking to understand how security is applied on Dashboards of the Salesforce Analytics Cloud powered by Wave?

Look no further!

I hope the following simplified version of the security implementation will help to explain the “How To” and helps anyone who wants to understand the security features.


The Data Security for Wave Dashboards does not have any correlation to the security settings setup within Salesforce platform. For ex., the Opportunity data could be locked down to the most restricted option within Salesforce, but once data is pulled into a Dataset within Wave, anyone who can access the data set can see all the data.

To restrict data access within Wave, Analytics Cloud provides a flexible row-level security option that could be implemented to individual Datasets.


Row-Level Security

To accomplish access control for each row within the Dataset, a filter condition called ‘Predicate’ is defined which is then executed when the Dataset is accessed by a user. Only the rows that match the security condition then trickle down to the user’s display.


The filter definition is quite flexible and can accommodate the most common security definitions as follows

  • Record ownership based access
  • Account/Opportunity team based access
  • Role hierarchy based access


Ownership Based Sharing

How we apply the predicate filter depends on the data source, if Salesforce data is pulled into Analytics Cloud via native Dataflow, then the filter setting is added as part of the JSON section that registers the Dataset. However, if an external data like CSV file is used, then the metadata that defines header (columns) is where the predicate filter will be defined.

In our case, let us assume we would create a Dataset based on the Opportunity data within Salesforce. We shall use the native Dataflow option available in Analytics Cloud. Below JSON will read the Opportunity data and creates a new Dataset with the same.

First action “Extract_Opp” will fetch the data from Opportunity object with the list of fields defined in the process. The second action will then make use of the Opportunity data and creates a new Dataset along with the security predicate filter.



“rowLevelSecurityFilter” attribute on the sfdcRegister action will apply the predicate condition while rendering the Dataset/dashboard.


The expression on the left hand side should be a column on the Dataset and right side expression is a global variable where it references the “logged” in user’s id. For each row this condition is applied to see if the record owner matches the logged in user.

Only matching rows are filtered to the Dataset and eventually to the dashboard, if no rows match then below message is returned to the user.

“No results meet those criteria. Try changing your filters.”


Team Based Sharing

If Opportunity Teams are being used in an org and to have the dashboards display relevant data based on team membership, the below JSON would handle that.

‘UserId’ attribute from the Opportunity Team Member object is used to match against the logged in user id. We need additional process of ‘Augment’ so we can join the data coming in from two different objects – OpportunityTeamMember and Opportunity.



If record ownership needs to be added to this security filter, the follow criteria will work.HowisSecurityAppliedImage3

Role Hierarchy Sharing

To grant record access based on role hierarchy, on each record we need a column that holds a list of role ids of all users that are above the record owner in the hierarchy chain.

It is little more complicated than the above two sharing options. We need the below set of processes to get to the hierarchy based sharing

  • Extract Opportunity
  • Extract User
  • Extract UserRole
  • Flatten UserRole

This generates a column where a list of comma-separated role ids of all parents of each record owner

  • Augment – Join user and UserRole
  • Augment – Join UserwithRoles and Opportunity
  • Register Dataset with predicate filter



CSV Data Security

When the source data is contained in a CSV file, the same predicate filters are applied along with the metadata that defines the number and type of columns included on the CSV.

In this scenario, ownerid is one of the columns on the CSV file and only rows that match with the logged in user is rendered on to the Dashboard/Dataset.


The basic use-case scenarios for implementing data security on the Salesforce Analytics cloud dashboard were illustrated in this document. For any additional information please feel free to reach out to us!




We’re a team of Salesforce enthusiasts, here to unlock the full potential of your CRM and Martech investments to support your sales and marketing strategies. With deep expertise on the Salesforce platform and a keen eye for adjacent technologies and process advancements, we provide thought leadership that keeps you informed.

We share strategic guidance on maximizing your Salesforce investments, in-depth insights on the latest Salesforce features and updates, cutting-edge solutions to integrate Salesforce with your broader tech stack, and expert analysis on trends shaping the future of CRM.

Ready to unleash the power of your Salesforce platform? Connect with us.

Topics: Data & Analytics, Salesforce, Salesforce Analytics Cloud, Salesforce Einstein

Solution-oriented technology is our specialty.