How Role Data Access Window Works in iDempiere

Introduction

The Role Data Access window lets an administrator fine-tune what a specific Role can see or change, going beyond the general access already granted through the Role and Organization setup.

It is used in System Administration, whenever a business needs a role restricted on a particular table, a single field, or a single record, instead of an entire window or menu.

These rules directly affect daily transactions and reporting, because a restricted role will not be able to view, edit, or report on the data covered by the rule.

Process Flow

Business Rules

• Rules set here apply only to the specific Role selected, not to every role in the tenant.
• A Table Access rule works together with, and can further limit, the role’s standard access level.
• Include with Read Only means the role can view the table but cannot add or change records.
• Exclude with Read Only removes edit rights while the role can still view the data.
• Exclude without Read Only removes both view and edit rights to the table.
• Column Access rules hide or restrict one field without restricting the whole table.
• Record Access rules apply to individual records, most often created through the Lock feature.
• Role details shown at the top of this window are for reference only and cannot be edited here.
• Access changes are cached, so affected users must log out and log back in to see the change.

Prerequisites

• Role already created and saved in the Role window.
• Organization and Client setup completed for the tenant.
• Table, Column, and Window entries available in the Application Dictionary.
• Login using System Administrator, or a role with System Admin menu access.
• Records to be restricted already exist, if Record Access is being configured.

Navigation

Menu → System Admin → General Rules → Security → Role Data Access

Opening the window shows the selected Role’s details at the top of the screen, displayed for reference only. Below this, three tabs appear: Table Access, Column Access, and Record Access, where the actual restriction rules are added, reviewed, or removed.

Note: The Role panel at the top of this window is read-only by design, for every role that opens it, including System Administrator. Role details such as name and preference level are maintained in the separate Role window, not here.

Configuration Steps

Step 1: Select the Role to Restrict

Every rule created in this window applies to one Role at a time, so the correct role must be selected before any restriction is added.

Instructions

Use Select Query or the navigation arrows to open the target Role, for example POTS Admin. Confirm the correct Tenant and Organization appear before proceeding.

Field	Sample Value	Description
Tenant	POTS	Business entity the role belongs to.
Organization	*	Organization scope; * means all organizations.
Name	POTS Admin	Role being restricted.

Step 2: Review the Role Reference Panel

Before adding rules, confirm the role’s existing permission flags, since these settings affect how far a new restriction reaches.

Instructions

Check flags such as Show Accounting, Can Report, Can Export, and Access all Orgs. These fields are read-only here and must be changed in the Role window instead.

Field	Sample Value	Description
Preference Level	Client	Level at which preference values apply for this role.
Access all Orgs	Unchecked	Whether the role can see every organization.
Can Export	Checked	Whether the role is allowed to export data.
Can Report	Checked	Whether the role is allowed to run reports.

Step 3: Restrict Table Access

Table Access rules stop a role from viewing or changing an entire table, useful when a role should never touch sensitive information such as costing or payroll data.

Instructions

Open the Table Access tab, click the New Record icon, choose the Table, mark Active, and set Exclude or Read Only depending on the level of restriction needed. Save the record.

Field	Sample Value	Purpose
Table	M_Product	Table the rule applies to.
Active	Checked	Enables the rule immediately.
Exclude	Checked	Removes access instead of granting it.
Read Only	Checked	Allows viewing without allowing edits.

Step 4: Restrict Column Access

Column Access rules hide or lock a single field, useful when only one piece of information, such as a cost or margin field, needs to stay hidden from a role.

Instructions

Open the Column Access tab, click the New Record icon, select the Table and the specific Column, then mark Exclude or Read Only as required. Save the record.

Field	Sample Value	Purpose
Table	M_Product	Table that owns the restricted column.
Column	PriceCost	Specific field being restricted.
Read Only	Checked	Column stays visible but cannot be edited.

Step 5: Restrict Record Access

Record Access rules restrict a single record rather than a whole table, commonly used to keep one sensitive document private to certain roles.

Instructions

Open the record to restrict, use the Lock toolbar button while holding Ctrl to create a Record Access entry, then confirm the entry under the Record Access tab for the selected role.

Field	Sample Value	Purpose
Table	C_Invoice	Table that owns the locked record.
Record	Invoice 1000123	Specific record being restricted.
Exclude	Checked	Removes this role’s access to the record.

Step 6: Apply the Changes

New or changed rules do not affect an active session immediately, since role access information is cached for performance.

Instructions

Ask affected users to log out and log back in, or reset the cache from System Administration, then confirm the restriction behaves as expected.

Common Issues and Resolutions

Issue	Cause	Resolution
Restriction not taking effect	Access information is cached	Log out and log back in, or reset the cache from System Administration.
Role panel fields cannot be edited	Role tab in this window is read-only by design	Edit role details, such as name or flags, in the Role window instead.
Role suddenly loses access to related windows	Include rule was added without its supporting tables	Add the related supporting tables, or restrict access using functionality instead of Include rules.
Record Access entry not created	Lock button was used without holding Ctrl	Hold Ctrl while clicking Lock to generate a Record Access entry for the role.
Restricted table still reachable	User navigated using the Zoom function	Add a Table Access rule here, since menu removal alone does not block data access.
Column still visible in a print or export	Column Access rule not linked to that report	Check whether the report or process reads the column directly and restrict it separately if needed.
Read Only not enforced on a record	A broader Table Access rule overrides the record rule	Review Table Access and Record Access together, since table-level rules are evaluated first.
Wrong role restricted	Similar role names in the same tenant	Confirm Tenant, Organization, and Role name before saving any new rule.

Next Steps

• Review the Role window to manage menu access and organization access.
• Check Table Access levels defined at the system level for each table.
• Test the restriction by logging in as a user assigned to the affected role.
• Document each restriction rule for future audit and support reference.