How do you enforce data access at the row level in Foundry?

• A. Use schema constraints that apply uniformly to all rows.
• B. Data policies or permission rules that filter rows for users or groups based on attributes.
• C. Only table-level permissions control access.
• D. Use data policies to rename sensitive rows.

Answer: (B)

Row-level access in Foundry is enforced by data policies or permission rules that filter rows based on user or group attributes. When a user queries a dataset, these policies apply predicates tied to the viewer’s identity, group membership, project, or other attributes, so only the rows the user is authorized to see are returned. This fine-grained filtering is what lets different users view different portions of the same table without changing the data itself.

This approach is preferable to schema constraints, which affect all rows uniformly regardless of who is querying, and to table-level permissions, which either allow or deny access to the entire table without per-row granularity. Renaming sensitive rows does not provide real security—it’s not actual access control. The right mechanism is to define a data policy that constrains visibility at the row level based on contextual attributes.