Analysts in one region must see only their region's rows in a shared table. Which control fits?
Why B is the answer
Row-level access control
Row-level security filters rows per user. Workspace access is all or nothing for that table, and labels classify data rather than filter it.
In detail
- Row-level access control filters rows for each user.
- The filter runs at query time, so one table serves every region.
Use case
An illustrative scenario, not a real incident.
A national retailer shares one sales table. A row filter on region means a manager in the north sees only northern sales, in the same report.
See it in different ways
flowchart TD A["Workspace roles"] --> B["Item permissions"] B --> C["Object-level security"] C --> D["Column-level security"] D --> E["Row-level security"]
mindmap
root((Access))
Workspace
Admin
Member
Contributor
Viewer
Item
Permission on one item
Data
Row-level security
Column-level security
Dynamic data masking
Governance
Sensitivity labels
DomainssequenceDiagram participant P0 as North analyst participant P1 as Warehouse participant P2 as Sales table P0->>P1: Run query P1->>P2: Apply region filter P2-->>P0: North rows only
Key point: Row-level security filters rows per user.
Why the other options are wrong
- A. Workspace-level access
- Workspace access is all or nothing for the table.
- C. A sensitivity label
- A label classifies data, and does not filter rows.
- D. Item endorsement
- Endorsement marks trusted items.