👋 Feature request: user attributes / RLS enforcement in SQL Runner We use user attributes (

sql_filter

,

required_attributes

) for role-based access to sensitive data. The issue: attribute filters don't apply in SQL Runner, so any Developer can query the underlying tables directly and see everything the project connection can see. In practice we can't give data builders Developer access without also giving them unrestricted access to sensitive data, which undermines the RBAC model for that data. What we'd love (any of these): 1. Enforce model-level

required_attributes

/

any_attributes

in SQL Runner, so tables a user can't access in Explore are also blocked there 2. Lightdash-side allowlist/denylist of schemas/tables for SQL Runner, attachable to roles, groups or user attributes 3. Separate permission to run SQL Runner vs. other Developer capabilities, available outside custom roles Looks related to #13908 (github.com/lightdash/lightdash/issues/13908). Is this on the roadmap, or has anyone solved it differently?

👋 Thanks for your message - someone from the Lightdash support team will get back to you asap. Feel free to add any additional context to the thread here in the meantime (screenshots, app version if you're self-hosting etc.).

Hey @hko! You've read this right, but there is a way to get enforcement on your plan! ❄️ On your Snowflake connection you can turn on "Require users to provide their own credentials" under the advanced settings. Each user then adds their own Snowflake credentials in their Lightdash settings and every query they run, SQL Runner included, executes as their own Snowflake user and role. That means your Snowflake grants decide which tables a Developer can touch, and if you need the row-level piece you can attach Snowflake row access policies to those roles. The trade-off is that everyone in the project needs to add credentials, so it works best if your users already have Snowflake identities. Docs are here. On the first two options you listed, enforcing attributes inside SQL Runner or a Lightdash-side allowlist isn't built yet. It's tracked here and I've added your use case to it: lightdash/lightdash#13908. Your third option exists as Custom Roles, which splits SQL Runner access out from the rest of Developer, but that's an Enterprise feature so I want to be upfront that it's not available on your current plan. Do your data builders already have their own Snowflake users?

Hi Tori! As far as I understand, turning on "require users to provide their own credentials" means that you cannot access any lightdash dashboard without having a lightdash user. Is that correctly understood, that turning on this feature results in us having to create users in Snowflake for all readers of Lightdash dashboards?