Loading

Explore & Permissions

Ask questions of the semantic layer, drill into the answers, and understand how permissions and small-number disclosure apply.

Using Explore

Explore is the quickest way to answer a question from a datastore: pick it, pick a figure, pick what to group by, and a chart appears. It needs no set-up beyond switching Business Intelligence on, because it works out what each field is from the datastore's own field types.

Where to find it

Architect Panel → Dashboards:

  • Explore — pick a datastore, a figure and a grouping, and see the chart

Admin Panel → Reporting:

  • Explore — the same screen for people who are not architects, once the item is granted

Exploring a datastore

  1. Choose a Datastore. Your own datastores are under "Your data", platform ones under "System". It runs straight away, showing the number of records.
  2. Choose the figure in Total and the calculation in How: Count, Distinct count, Total, Average, Lowest or Highest.
  3. Choose a field in Grouped by, or leave "Nothing (one figure)". Grouping by a text or dropdown field shows the top 15 values plus "Other".
  4. Grouping by a date shows Period: Day, Week, Month (the default), Quarter or Year. This is how dates are grouped, not a date range; empty periods are filled in so gaps show.
  5. Change Show as if "Chosen automatically" is not the chart you want.
  6. Click a bar or point to see the records behind it, up to 500, listed under the chart. Click a record to open it.

The Try: row offers suggested questions for the chosen datastore.

Which fields can be used

  • Numbers can be totalled and averaged.
  • Dates group by period.
  • Dropdowns, pills and radio buttons group.
  • Tickboxes and toggles count how many are Yes.
  • Every datastore also offers Number of records, Record ID, Created, Last updated, Created by and Last updated by.

To relabel a field, change its role or hide it from Explore, add a row for it in the BI Field Settings datastore under Data → Datastores. With no row, Explore works it out from the field type. See The Semantic Layer.

Saving and exporting

  • Download CSV saves the figures shown.
  • Save query asks "Name this query:" and saves it for everyone who can use Explore. Reopen it from Saved queries….

Explore has no filters, no date range and no way to add a chart to a dashboard. For those, build the report in the Report Builder. See The Report Builder.

What goes wrong and how to tell

  • "There are no datastores you have access to, so there is nothing to report on.": your security group has no Read permission on any datastore.
  • A field is missing: you have no access to it, it is encrypted, or it is a type Explore cannot use.
  • A chart type shows "(not installed)": it cannot be drawn on this system.
  • Explore says Business Intelligence is switched off: switch it on in Platform Modules.

Worked example

A volunteer co-ordinator wonders whether sign-ups are rising. They open Explore, choose Volunteers, leave Total as Number of records, group by Created, and see a monthly bar chart. October looks high, so they click the October bar and read the 42 records behind it: a recruitment event explains the jump. They save the query as "Volunteer sign-ups by month" for their colleagues.

Recommendations

  • Use Explore for questions, the Report Builder for reports.
  • Click through to the records before acting on a surprising figure.
  • Name saved queries clearly; they are visible to everyone with access.
  • Tidy field labels in BI Field Settings where the raw names confuse people.

Who Sees What

Business Intelligence never lets a report show somebody data they could not see on screen. Every query, chart and dashboard runs as the person looking at it, with their permissions, so the same report can show different numbers to different people. This article sets out who can open each screen and what each person's results include.

Where to find it

Architect Panel → Dashboards:

  • Explore — quick questions of one datastore
  • BI Dashboards — shared dashboards of charts

Architect Panel → Data:

  • Report Builder — building and saving reports

Admin Panel → Reporting:

  • Explore — for people who are not architects
  • Dashboards — for people who are not architects
  • Report Builder — for people who are not architects

Who can open each screen

  • Nothing works until Business Intelligence is switched on in Platform Modules.
  • Architects can open all three from the Architect Panel.
  • Everyone else reaches them through the Admin Panel's Reporting items, which ship granted to nobody. Grant each item to the security groups that should have it (see Admin Panel).
  • The Report Builder checks its own grant: someone without it sees "You do not have access to the Report Builder." Explore and Dashboards are open to any administration-screen user who can reach them.

What each person's results include

  1. Datastores: only those the person's security groups have permissions on are offered, and opening one needs Read. Datastores holding credentials or sessions are never offered to anyone.
  2. Fields: a field the person has No Access to is removed completely, so it cannot be shown, grouped, filtered or drilled into. Encrypted fields are never available.
  3. Records: deleted records are excluded; each datastore's organisation sharing applies; record access rules apply even inside totals; and classification and clearance apply.

A total therefore counts only the records the viewer may see. A manager and a team member looking at "Cases by team" may see different numbers, and both are correct for them.

Saved queries and dashboards

  • Saved reports are visible to everyone with access unless "Who can see this" limits them to groups. Architects see all of them. Queries saved from Explore are always visible to everyone with access.
  • Dashboards are private to their owner until shared with a security group as view, edit or manage. See Building a Dashboard.
  • Scheduled deliveries run as the person who set them up, so recipients get what that person can see.
  • The Dataset API runs as the API key's account.

What goes wrong and how to tell

  • "There are no datastores you have access to": the person's group has no Read permission on any datastore.
  • "You do not have access to" a datastore: they can see it listed but lack Read.
  • Different totals for different people: expected; check each person's record access before treating it as a fault.
  • Cached charts: if a chart is cached, a change to someone's access shows only when the cache expires.

Worked example

A council grants Reporting → Dashboards to all service managers and Reporting → Report Builder only to its two analysts. The analysts build "Complaints by service" and add it to a shared dashboard. The housing manager, whose record access covers housing complaints only, sees one bar; the chief executive's office, with access to every service, sees them all. Nobody had to build separate reports.

Recommendations

  • Set datastore and field permissions first; BI follows them.
  • Grant the Report Builder to a few people and dashboards widely.
  • Limit saved reports with Who can see this where the subject is sensitive.
  • Leave chart caching off for sensitive data.