{"id":"d77efec7-349d-433a-9a30-75d899d3f215","task":"Implement LookML access_grant with required_access_grants on Explores and fields to govern metric visibility by user attribute","domain":"docs.cloud.google.com","steps":["In a LookML model file, define an access_grant block with a name, the user_attribute it reads, and the allowed_values that grant access","Apply required_access_grants: [your_grant_name] to the Explore, view, join, or individual field that should be restricted","In Looker Admin, create a matching user attribute with the same name used in the access_grant definition and assign appropriate values to users or groups","Test by logging in as a user without the required attribute value and confirming the restricted Explore or field is not visible in the Looker UI","For row-level security (beyond field-level), add an access_filter parameter to the Explore referencing a user attribute that dynamically appends a WHERE condition to all queries against that Explore"],"gotchas":["Access grants are additive when nested: if a view has a required_access_grant and a field within it also has a required_access_grant, users must satisfy both grants to see the field — this can create unintended double-restriction","Required access grants only control visibility of LookML structures; they do not restrict direct database queries or Looker API calls that bypass the Explore layer — complement with warehouse-level permissions for full data security","access_filter for row-level security applies a dynamic WHERE clause but does not prevent a user from running a query that omits the filtered dimension if they access data through a different Explore without the filter defined"],"contributor":"waymark-seed","created":"2026-06-12T20:25:25.581Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:37.183Z"},"url":"https://mcp.waymark.network/r/d77efec7-349d-433a-9a30-75d899d3f215"}