Hi All,
In our organization, data security is highly customized and complex. A single user can have multiple custom data roles assigned based on different security contexts, such as Line Manager, Regional Manager, Country, Area of Responsibility (AOR), Organization, and other business-specific access rules.
One of the major challenges we face is troubleshooting data-access issues in FDI. For example, a business user may:
- Not be able to see the data they are expected to see, or
- Be able to see significantly more data than they should.
In these scenarios, we need an effective way to identify which custom data roles and security rules were applied when the report query was executed.
Currently, while troubleshooting through the execution SQL or Logical SQL, we can see the dimension-level filters and objects in the WHERE clause. However, this does not clearly indicate which data role, security context, or security assignment caused those filters to be applied.
It would be extremely valuable if FDI could provide security lineage for report execution, showing information such as:
- Custom data roles evaluated for the logged-in user
- Data roles that were actually applied to the query
- Security predicates generated by each role
- A mapping between the security predicate and the originating data role
- Relevant security context, such as Line Manager, Regional Manager, Country, AOR, or Organization
For example, instead of troubleshooting only a generated predicate such as:
WHERE Country = 'IN' AND Organization IN (...)
it would be much more useful to understand that these predicates originated from something like:
Country Security Role -> Country = 'IN'
Organization Data Role -> Organization IN (...)
This would significantly reduce troubleshooting time for complex security issues and help administrators quickly determine why a user can or cannot see specific data.
I believe this is a strong business requirement for customers with complex customized security models. Providing end-to-end data security lineage and explainability in FDI would improve supportability, accelerate issue resolution, and ultimately help customers drive greater FDI adoption.
Regards,
Guru
