Skip to content

EntiHub Documentation

Org / RLS Entitlement Matrix

Org / RLS Entitlement Matrix

Org scope entities (region, cost center, brand) become the building blocks of EntiHub RLS and downstream warehouse filters.

Why this is needed

Reorgs break Power BI RLS when scopes live only in report code.
One scope model should feed EntiHub UI and warehouse RLS.
HRBP/Finance access often follows org hierarchy.

Proposed entities in EntiHub

Governance settings

Setting	Recommended value	Why
`approvalRequired`	`true`	Scope membership changes are sensitive.
`historyEnabled`	`true`	History explains access after reorg.
`allowSameAuthorApproval`	`false`	Maker/checker separation for sensitive changes.
`deletedRetentionDays`	`90` (or higher)	Soft-delete retention for auditability.

Entity definition (YAML sketch)

name: org_scope
displayName: Org scope
domain: Security
description: Org scope
version: "1.0.0"
approvalRequired: true
historyEnabled: true
deletedRetentionDays: 90
displayRefColumn: scope_code
uniqueConstraints:
  - name: uq_org_scope_scope_code
    columns: [scope_code]
columns:
  - name: scope_code
    dataType: string
    nullable: false
    maxLength: 64
  - name: scope_type
    dataType: string
    nullable: false
    maxLength: 32
  - name: name
    dataType: string
    nullable: false
    maxLength: 128
  - name: parent_scope_code
    dataType: string
    nullable: true
    maxLength: 64
  - name: status
    dataType: string
    nullable: false
    maxLength: 16

YAML sketches

Sketches highlight the important fields and governance flags. Trim or extend columns to match your domain. See Setup Entity for the full YAML reference.

Sample data

scope_code	scope_type	name	parent_scope_code	status
REG-EU	region	Europe		active
REG-DACH	region	DACH	REG-EU	active
BRAND-CORE	brand	Core brand		active

Benefits for the company

Single scope model for EntiHub and BI RLS.
Reorgs become effective-dated data changes.
Easier to explain who sees what.