Record Access (RLS)
Besides permissions on a record type as a whole (role CRUD permissions — "can read tickets", "can delete clients"), Orbita can restrict access at the level of individual records: who sees and who can modify which rows. This is configured in the entity builder, on the Record Access tab.
How rules work
- A rule = a role (or "All roles") + an operation (Read or Edit/Delete) + a rule type.
- Rules of one entity are combined with OR: a single matching rule is enough to make a record accessible.
- Edit/Delete implies read: a user allowed to modify a record can always view it.
- The admin role is never restricted by rules — administrators always see all records.
Secure by default
If an entity has no rules configured, regular users see no records at all — even with a CRUD permission on the entity. After granting CRUD permissions to a role, remember to add at least one record access rule (e.g. "All records").
Rule types
| Type | What it opens | Example |
|---|---|---|
| All records | The whole entity without row filtering | Support operators see all tickets |
| Own records (created_by) | Only records created by the user | An employee sees only their own requests |
| Field equals user attr | Records where the chosen field matches a user attribute (User ID, Org unit ID, Company ID) | Record department_id = user's org unit: each department sees only its records |
| Array field contains me | Records where a list field contains the user attribute | The assignees field contains the user ID: assignees see tasks assigned to them |
For "Field equals user attr" and "Array field contains me" you specify two parameters: the record field and the user attribute (User ID / Org unit ID / Company ID).
Typical configurations
Service desk ("Tickets" entity):
| Role | Operation | Rule |
|---|---|---|
| Operator | Read | All records |
| Operator | Edit/Delete | Array field assignees contains user ID |
| Employee | Read | Own records (created_by) |
Operators see the whole queue but can only modify their assignments; requesters see only their own tickets.
Cross-department registry ("Documents" entity):
| Role | Operation | Rule |
|---|---|---|
| All roles | Read | Field department_id = user's org unit ID |
| Manager | Read | All records |
Each department works with its own documents; management sees everything.
What obeys the rules
The rules apply everywhere entity records are read:
- record lists and cards in the UI;
- reports — including scheduled exports (run with the report owner's permissions);
- the REST API.
Business process tasks are a special case: their visibility is driven by assignment (assignee, candidate roles/groups/org units), and a fully unassigned task is visible to everyone as a "shared inbox". See Processes and tasks.
See also
- Users, groups, roles — CRUD permissions at the record type level
- Entity builder overview