SAC Security & Row-Level Access

As of 2026-05-29

SAC security = 3 layers: tenant/roles (least privilege, no named admins), model access (read-only production models), row-level (DSP DAC via live connection preferred over SAC-side import DAC). DAC in DSP = enterprise-grade: inherited at query time, single source of truth, zero SAC maintenance. Column security: restricted measure returning NULL in DSP AM. Security test protocol: 5 test users per region, filter bypass attempt, planning data isolation. Joule respects DAC.