Power BI Row-Level Security Rules Review (Defensive)
Review the row-level security roles on your own Power BI model for gaps, overlaps and test coverage, with a checklist for safe validation.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Please help me review the row-level security (RLS) design of a Power BI model that I own, so that each person sees only the data they should. This is a defensive check of my own setup. Do not suggest ways to evade security. Mark every statement about Power BI behaviour, DAX or service settings [VERIFY]. Inputs: the business rule for who may see what, in words [ACCESS_RULES_IN_WORDS], the roles with their filter expressions [ROLE_DEFINITIONS], the table structure involved, including the security mapping table if any [TABLES_AND_MAPPING], the list of groups or user types and which role each is assigned to [ROLE_ASSIGNMENTS], and any users who need to see everything [FULL_ACCESS_USERS]. Produce: (1) a rules-versus-implementation table with columns Rule in words, Role that should enforce it, Filter expression, Does it match? (Yes / Partly / No / Cannot tell), Gap; (2) potential gaps to check: users without any role, users in more than one role, rows with blank or unknown keys, filters applied on the wrong side of a relationship, dimension tables not secured, and measures that could reveal totals; (3) a test matrix with columns Test user type, Expected rows or totals, How to check (view as role), Result to record; show a worked comparison of a total with and without a role; (4) change-control suggestions: who approves role changes, and when they are reviewed; (5) a short summary for the data owner under 120 words. Guardrails: do not ask for real data, names or credentials. This is not a security certification; involve the organisation's security or data governance contact for sensitive data. Do not claim that RLS protects you in every scenario. Add a worked example with invented values: Region A manager role filters Region = "A". Total sales 1,000 across the model, 220 in Region A. Show the expected check value 220.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.