> ## Documentation Index
> Fetch the complete documentation index at: https://www.propeldata.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Access Policies
> Fine-grained control over Data Pool access with column and row-level rules
Access Policies determine which rows and columns of a Data Pool are accessible. They can have multiple rules, including row-level rules with static or dynamic values.
## Creating and assigning Access Policies
Follow these steps to create an Access Policy via the Console:
1. Go to the desired Data Pool.
2. Open the **"Access Policies"** tab.
3. Click **"Add new policy"**.
4. Define column and row access controls.
5. Assign Applications to the Policy.
6. Name and describe the policy.
7. Review and click **"Create"**.
8. Enable Access Control on the Data Pool.
## Column-level rules
Column-level rules define which specific columns of a Data Pool are accessible.
```graphql theme={"system"}
mutation {
createDataPoolAccessPolicy(input: {
uniqueName: "Column-specific Access Policy",
description: "Limits access to specific columns",
dataPool: "DPO00000000000000000000000000",
columns: ["taco_name", "taco_total_price"]
}) {
dataPoolAccessPolicy {
dataPool { id }
id
uniqueName
}
}
}
```
```hcl theme={"system"}
resource "propel_data_pool_access_policy" "column_specific_policy" {
unique_name = "Column-specific Access Policy"
description = "Limits access to specific columns"
data_pool = "DPO00000000000000000000000000"
columns = ["taco_name", "taco_total_price"]
applications = ["APP00000000000000000000000000"]
}
```
To grant access to all columns, use the wildcard `"*"`:
```graphql theme={"system"}
mutation {
createDataPoolAccessPolicy(input: {
uniqueName: "All-columns Access Policy",
description: "Grants access to all columns",
dataPool: "DPO00000000000000000000000000",
columns: ["*"]
}) {
dataPoolAccessPolicy {
dataPool { id }
id
uniqueName
}
}
}
```
```hcl theme={"system"}
resource "propel_data_pool_access_policy" "all_columns_policy" {
unique_name = "All-columns Access Policy"
description = "Grants access to all columns"
data_pool = "DPO00000000000000000000000000"
columns = ["*"]
applications = ["APP00000000000000000000000000"]
}
```
## Row-level rules
Row-level rules determine which specific rows of a Data Pool are accessible.
```graphql theme={"system"}
mutation {
createDataPoolAccessPolicy(input: {
uniqueName: "Row-level Access Policy",
description: "Limits access to a specific rows",
dataPool: "DPO00000000000000000000000000",
columns: ["*"],
filterSql: "restaurant_name = 'Farolito'"
}) {
dataPoolAccessPolicy {
dataPool { id }
id
uniqueName
}
}
}
```
```hcl theme={"system"}
resource "propel_data_pool_access_policy" "restaurant_specific_policy" {
unique_name = "Row-level Access Policy"
description = "Limits access to a specific rows"
data_pool = "DPO00000000000000000000000000"
columns = ["*"]
row {
column = "restaurant_name"
operator = "EQUALS"
value = "Farolito"
}
applications = ["APP00000000000000000000000000"]
}
```
### Dynamic values row-level rules
For more flexible policies, you can use dynamic values from the JWT token in row-level rules:
```graphql theme={"system"}
mutation {
createDataPoolAccessPolicy(input: {
uniqueName: "Dynamic row-level Access Policy",
description: "Filters restaurants based on JWT token",
dataPool: "DPO00000000000000000000000000",
filterSql: "restaurant_name = ${{ restaurant_name }}"
}) {
dataPoolAccessPolicy {
dataPool { id }
id
uniqueName
}
}
}
```
```hcl theme={"system"}
resource "propel_data_pool_access_policy" "dynamic_restaurant_policy" {
unique_name = "Dynamic row-level Access Policy"
description = "Filters restaurants based on JWT token"
data_pool = "DPO00000000000000000000000000"
columns = ["*"]
row {
column = "restaurant_name"
operator = "EQUALS"
value = "${{ restaurant_name }}"
}
applications = ["APP00000000000000000000000000"]
}
```
For a deep dive into dynamic values and building multi-tenant applications, refer to our [Multi-tenant JWT Tokens](/docs/multi-tenant-jwt-tokens) guide.
## Assigning Access Policies to Applications
Access Policies are assigned to Applications to enforce data access controls.
A Data Pool can have multiple Policies, each assigned to multiple Applications. An Application can have at most one Policy per Data Pool.
Key points to remember:
* A Data Pool can have multiple Policies
* Each Policy can be assigned to multiple Applications
* An Application can have at most one Policy per Data Pool
## Access Policies and Metrics
Metrics automatically inherit Access Policies from their parent Data Pool. An Application can only query a Metric if its Access Policy permits access to all columns used in that Metric's definition.