Understanding this table

Each row below is an independent scenario. The five left-hand columns are configuration conditions (Yes/No); the right-hand column is the resulting RLS behavior the user experiences in a Native Dashboard.

Conditions are evaluated top-down — once a row's exact Yes/No combination matches, that is the outcome.

Terms used in this table:

• User Group Feature Enabled — whether the User Group feature is turned on for the organization. User Groups in Eightfold allow you to organize users into logical groups and manage their access collectively. To learn more, read Dynamic Role Based Access Control (User Groups)
• User in ≥1 User Group — whether the individual user belongs to at least one user group
• ≥1 Linked Group Has Role — whether at least one of the user's groups has a role linked to it
• ≥1 Linked Role Has Permissions — whether at least one of those linked roles has permissions defined
• ≥1 Linked Role Has Access Criteria — whether at least one of those linked roles has Access Criteria (the actual data filter rule) defined

RLS outcomes by configuration

Legend: 🟩 Data filtered correctly  |  🟨 No filtering (open access)  |  🟥 Not possible / misconfigured  |  🟧 Orphan user (no access)

What "Not Possible" means: This isn't something the product blocks you from configuring — it means the setup is invalid or incomplete. Specifically, if the role is missing Permissions, the configuration cannot resolve into a working RLS outcome, regardless of whether Access Criteria is defined.

What to remember

• RLS only filters data when all four conditions are met: a user group with a role, permissions, and Access Criteria all defined and linked through to the user.
• Missing Access Criteria (with Role + Permissions present) means the user sees all data with no filtering — this is expected behavior, not an error state.
• Missing Permissions on the role is the failure point that makes the configuration "Not Possible," regardless of whether Access Criteria exists.
• A user with no user group at all is an orphan — they cannot access the dashboard, regardless of any downstream configuration.
• If the User Group feature itself is disabled org-wide, no RLS filtering is applied to anyone, regardless of group/role/permission setup.
• The Admin role always bypasses filtering, even if Access Criteria is defined.