Loading

Who Sees What

Business Intelligence never lets a report show somebody data they could not see on screen. Every query, chart and dashboard runs as the person looking at it, with their permissions, so the same report can show different numbers to different people. This article sets out who can open each screen and what each person's results include.

Where to find it

Architect Panel → Dashboards:

  • Explore — quick questions of one datastore
  • BI Dashboards — shared dashboards of charts

Architect Panel → Data:

  • Report Builder — building and saving reports

Admin Panel → Reporting:

  • Explore — for people who are not architects
  • Dashboards — for people who are not architects
  • Report Builder — for people who are not architects

Who can open each screen

  • Nothing works until Business Intelligence is switched on in Platform Modules.
  • Architects can open all three from the Architect Panel.
  • Everyone else reaches them through the Admin Panel's Reporting items, which ship granted to nobody. Grant each item to the security groups that should have it (see Admin Panel).
  • The Report Builder checks its own grant: someone without it sees "You do not have access to the Report Builder." Explore and Dashboards are open to any administration-screen user who can reach them.

What each person's results include

  1. Datastores: only those the person's security groups have permissions on are offered, and opening one needs Read. Datastores holding credentials or sessions are never offered to anyone.
  2. Fields: a field the person has No Access to is removed completely, so it cannot be shown, grouped, filtered or drilled into. Encrypted fields are never available.
  3. Records: deleted records are excluded; each datastore's organisation sharing applies; record access rules apply even inside totals; and classification and clearance apply.

A total therefore counts only the records the viewer may see. A manager and a team member looking at "Cases by team" may see different numbers, and both are correct for them.

Saved queries and dashboards

  • Saved reports are visible to everyone with access unless "Who can see this" limits them to groups. Architects see all of them. Queries saved from Explore are always visible to everyone with access.
  • Dashboards are private to their owner until shared with a security group as view, edit or manage. See Building a Dashboard.
  • Scheduled deliveries run as the person who set them up, so recipients get what that person can see.
  • The Dataset API runs as the API key's account.

What goes wrong and how to tell

  • "There are no datastores you have access to": the person's group has no Read permission on any datastore.
  • "You do not have access to" a datastore: they can see it listed but lack Read.
  • Different totals for different people: expected; check each person's record access before treating it as a fault.
  • Cached charts: if a chart is cached, a change to someone's access shows only when the cache expires.

Worked example

A council grants Reporting → Dashboards to all service managers and Reporting → Report Builder only to its two analysts. The analysts build "Complaints by service" and add it to a shared dashboard. The housing manager, whose record access covers housing complaints only, sees one bar; the chief executive's office, with access to every service, sees them all. Nobody had to build separate reports.

Recommendations

  • Set datastore and field permissions first; BI follows them.
  • Grant the Report Builder to a few people and dashboards widely.
  • Limit saved reports with Who can see this where the subject is sensitive.
  • Leave chart caching off for sensitive data.