# Lookml Access Grants

> Use this skill to create Access Grants for row-level or object-level security.

- Skill: `looker-open-source/lookml-access-grants` (Agent Skill)
- Install (CLI): `npx skillmds@latest add looker-open-source/lookml-access-grants`
- Raw SKILL.md: https://api.skillmd.com/api/skills/looker-open-source/lookml-access-grants/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: looker-open-source (https://skillmd.com/u/looker-open-source)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/looker-open-source/lookml-access-grants

---


# Instructions

1.  **Define Access Grant**:
    *   Defined at the **Model** level.
    *   Links a `user_attribute` to a set of `allowed_values`.
2.  **Apply Access Grant**:
    *   Use `required_access_grants: [grant_name]` at the Explore, Join, View, or Field level.
    *   User must match **all** listed grants to see the object.
3.  **Best Practices**:
    *   **Exact Match**: `allowed_values` must match the user attribute value distinctively (no wildcards/partial matches).
    *   **Additive**: Grants are additive. If a View requires Grant A and a Field requires Grant B, the user needs *both* to see the field.

# Examples

## Basic Access Grant

```lookml
# In model file
access_grant: can_view_finance {
  user_attribute: department
  allowed_values: ["finance", "executive"]
}

# In view file
view: finance_data {
  required_access_grants: [can_view_finance]
  # ...
}
```

## Field-Level Security

```lookml
dimension: salary {
  type: number
  sql: ${TABLE}.salary ;;
  required_access_grants: [can_view_finance]
}
```