# How do I restrict access to a column using AML syntax

**URL:** <https://community.holistics.io/t/how-do-i-restrict-access-to-a-column-using-aml-syntax/670>\
**Category:** Ask the Community\
**Tags:** aml, access-control\
**Created:** [January 14, 2022, 12:42pm UTC](https://community.holistics.io/t/how-do-i-restrict-access-to-a-column-using-aml-syntax/670 "2022-01-14T12:42:37Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mabr](https://community.holistics.io/user_avatar/community.holistics.io/mabr/32/407_2.png) [@mabr](https://community.holistics.io/u/mabr)\
**Post date:** [January 14, 2022, 12:42pm UTC](https://community.holistics.io/t/how-do-i-restrict-access-to-a-column-using-aml-syntax/670/1 "2022-01-14T12:42:37Z")

</div>

Hi  
I am trying to enforce access control for our dimensions and measures based on user attributes.  
I am aware I can replace values for fields based on a user attribute using SQL as described here: [Column-level Permission | Holistics Docs](https://docs.holistics.io/docs/access-control/column-level-permission)

Since As-code has been released I was wondering if there is a field attribute that controls access to the field?  
Ideally, I would want to hide or show certain fields based on the user attribute.

---

<div class="post-metadata">

**Author:** ![Khai\_To](https://community.holistics.io/user_avatar/community.holistics.io/khai_to/32/128_2.png) [@Khai\_To](https://community.holistics.io/u/Khai_To)\
**Post date:** [January 17, 2022, 3:25am UTC](https://community.holistics.io/t/how-do-i-restrict-access-to-a-column-using-aml-syntax/670/2 "2022-01-17T03:25:10Z")

</div>

Hi @mabr ,

Yes, you can use Column level permission in the As-code version. Just one note is that the syntax to define column level permission is aml, not SQL. Let’s me add an example below

 ![image](https://community.holistics.io/uploads/default/original/1X/53cd616b41ea4b902239cdb27cd218ab054f5d9c.png)

Let’s say in the model, I have a dimension email defined by using `@sql {{ #SOURCE.email }}`  
For the PII dimension below, I need to define the field by using `@aml`

The full syntax is

```jsx

// original field  
dimension email {
  label: 'Email'
  type: 'text'
  hidden: false
  definition: @sql {{ #SOURCE.email }};;
}

// pii field
dimension customer_email_pii {
  label: "Customer Email Pii"
  type: 'text'
  definition: @aml case(
      when:
        in(1, H.current_user.pii_access),
      then: ecommerce_users.email,
      else: '(redacted)'
    );;
}

```

Do note that our column level permission can only be applied to Explorers, Viewers, and Analysts who don’t have access to the underlying Data Source.

---

<div class="post-metadata">

**Author:** ![mabr](https://community.holistics.io/user_avatar/community.holistics.io/mabr/32/407_2.png) [@mabr](https://community.holistics.io/u/mabr)\
**Post date:** [January 17, 2022, 6:58am UTC](https://community.holistics.io/t/how-do-i-restrict-access-to-a-column-using-aml-syntax/670/3 "2022-01-17T06:58:17Z")

</div>

Hi Khai  
That makes sense.

Do you have any plans to expand the options to also control who can see specific fields in the UI?

---

<div class="post-metadata">

**Author:** ![Khai\_To](https://community.holistics.io/user_avatar/community.holistics.io/khai_to/32/128_2.png) [@Khai\_To](https://community.holistics.io/u/Khai_To)\
**Post date:** [January 17, 2022, 7:43am UTC](https://community.holistics.io/t/how-do-i-restrict-access-to-a-column-using-aml-syntax/670/4 "2022-01-17T07:43:03Z")

</div>

Hi @mabr ,  
Could you share more about your use case?

---

<div class="post-metadata">

**Author:** ![mabr](https://community.holistics.io/user_avatar/community.holistics.io/mabr/32/407_2.png) [@mabr](https://community.holistics.io/u/mabr)\
**Post date:** [January 17, 2022, 8:46am UTC](https://community.holistics.io/t/how-do-i-restrict-access-to-a-column-using-aml-syntax/670/5 "2022-01-17T08:46:11Z")

</div>

Yes - We have a dataset with several financial fields, that not all employees are allowed to see.  
Instead of just redacting the values of the field, I want to hide the field for users with a certain attribute.

This would give a better experience for users.

My workaround is, that I will create a lite-version of our financial dataset and for other datasets, with fewer fields that need to be redacted, I will use your aml solution.

---

<div class="post-metadata">

**Author:** ![Khai\_To](https://community.holistics.io/user_avatar/community.holistics.io/khai_to/32/128_2.png) [@Khai\_To](https://community.holistics.io/u/Khai_To)\
**Post date:** [January 17, 2022, 2:56pm UTC](https://community.holistics.io/t/how-do-i-restrict-access-to-a-column-using-aml-syntax/670/6 "2022-01-17T14:56:29Z")

</div>

> [@mabr](#):
>
> Yes - We have a dataset with several financial fields, that not all employees are allowed to see.  
> Instead of just redacting the values of the field, I want to hide the field for users with a certain attribute

Hi @mabr ,  
I do understand the use case is more about the UX for the end-users. For now we don’t have this but I will add this use case into our backlog for further discussion.  
Thank you for the suggestion 😁