mcpField
L
lookml-access-grants

lookml-access-grants

github.com/looker-open-sourceSecurity43140 installsUpdated 2w ago
Repository

About lookml-access-grants

lookml-access-grants is a skill for defining and applying LookML access grants to control which users can see explores, joins, views, and fields. It explains user-attribute matching and how requirements combine across levels.

Key features

  1. 01Define grants using user attributes
  2. 02Apply grants to explores, joins, views, and fields
  3. 03Require exact allowed-value matches
  4. 04Combine grants across object levels

Use cases

  1. 01Restrict a view to selected departments
  2. 02Limit access to sensitive fields such as salary

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/looker-open-source/looker-skills --skill lookml-access-grants

After installing, type/lookml-access-grantsin Claude Code to confirm it loaded.

Details

From the project README

Instructions

  1. Define Access Grant:
    • Defined at the Model level.
    • Links a user_attribute to a set of allowed_values.
  2. Apply Access Grant:
    • Use required_access_grants: [grant_name] at the Explore, Join, View, or Field level.
    • User must match all listed grants to see the object.
  3. Best Practices:
    • Exact Match: allowed_values must match the user attribute value distinctively (no wildcards/partial matches).
    • Additive: Grants are additive. If a View requires Grant A and a Field requires Grant B, the user needs both to see the field.

Examples

Basic Access Grant

# In model file
access_grant: can_view_finance {
  user_attribute: department
  allowed_values: ["finance", "executive"]
}

# In view file
view: finance_data {
  required_access_grants: [can_view_finance]
  # ...
}

Field-Level Security

dimension: salary {
  type: number
  sql: ${TABLE}.salary ;;
  required_access_grants: [can_view_finance]
}

Comments

Markdown supported