Updated August 2026. The model-access section was rewritten: the original access_grant syntax was invalid and conflated access grants with model sets.
Looker is a versatile data analytics platform that allows businesses to gain meaningful insights from their data. However, not every piece of information is relevant for all users, and some data might be confidential or sensitive. Hence, managing access to data becomes crucial. Looker provides a feature known as role-based access control (RBAC), which allows administrators to control who can see and do what within the Looker platform. This article will guide you through implementing role-based access control in Looker.
Understanding Looker Permissions
At the core of Looker's RBAC are permissions. These are specific abilities that you can grant to user roles. Examples of permissions include 'see_lookml', 'see_user_dashboards', 'create_table_calculations', etc.
Users can't have permissions directly assigned to them; instead, permissions are assigned to roles, and roles are then assigned to users or groups. This layer of abstraction allows for a flexible and easily maintainable access control structure.
Creating and Managing Roles
To create a role, navigate to the Admin panel, then select 'Roles' from the sidebar. Click 'Create Role' and name your role according to its responsibilities or the user group it corresponds to, like 'Data Analyst', 'Marketing', etc.
Once you've created a role, you can start assigning permissions to it. This is done from the same 'Roles' page. Click on a role to edit it, then select the permissions you want this role to have. Click 'Update Role' when you're done.
Assigning Roles to Users and Groups
Now that you've defined some roles, you can start assigning them to users and groups. You can assign roles to individual users from the 'Users' page in the Admin panel. Click on a user to edit them, then select 'Add Roles' to add one or more roles to this user.
Alternatively, you can create groups of users and assign roles to the whole group. This is particularly useful if you have a lot of users, as it saves you from having to assign roles to each user individually. Navigate to the 'Groups' page in the Admin panel to create groups and assign roles.
Managing Model Access
In Looker, the term 'model' refers to a LookML model, which is a project file that defines the connections between database tables and the visualizations in Looker. You can control which roles have access to which models.
Which models a user can see is governed by the model set attached to their role (Admin > Roles > Model Sets), not by LookML. A role is a permission set plus a model set; if the finance model is not in the role's model set, the user cannot see any of its explores.
Within a model, LookML can restrict specific explores, joins or fields with an access grant. An access grant is declared at the model level with a name and a user attribute, and it does nothing on its own; it takes effect only where it is referenced with required_access_grants:
# finance.model.lkml
access_grant: finance_only {
user_attribute: department
allowed_values: ["Finance", "Executive"]
}
explore: payroll {
required_access_grants: [finance_only]
}
view: employees {
dimension: salary {
type: number
sql: ${TABLE}.salary ;;
required_access_grants: [finance_only]
}
}
In this example only users whose department user attribute is Finance or Executive can open the payroll explore or see the salary field; everyone else with the model in their model set still sees the rest. The department attribute is set by an administrator on the user or group, and should be locked so users cannot edit it themselves. For filtering rows rather than hiding fields, use access_filter on the explore; we cover the complete set of patterns in Row-Level Security Patterns.
Conclusion
Implementing role-based access control in Looker allows you to fine-tune who has access to what data and capabilities in your Looker platform. By carefully assigning permissions to roles, then assigning those roles to users or groups, you can ensure that each user only sees the data they need to see, without risking exposing sensitive information. Moreover, model sets control which models a role can see, and access grants with required_access_grants restrict specific explores and fields based on user attributes. RBAC is a powerful tool for managing access to your data, and it's a key part of maintaining the security and integrity of your Looker platform.