Section Access

Section Access is Qlik’s row-level security: it decides which data each person sees inside an app. In Qovern, the rules live on their own screen, outside the load script, and every change is validated, published to Qlik and recorded in the audit trail.

How it works

1. You edit the app’s rules on the Section Access screen.
2. When you click Save and Apply Rules, Qovern validates everything, stores a new version and generates a CSV file.
3. The CSV is sent to the DataFiles connection of the app’s space in Qlik.
4. In the same click, Qovern inserts or updates the script in the app and asks Qlik to reload the app, and the new rules take effect.

The app’s script gets a Section Access tab that reads this file. You no longer need to edit the script to change who sees what.

Put an app under management

1. In Apps, find the app and click Bring Section Access under management.
2. Qovern creates the first rule, a protected ADMIN row for the app owner, and inserts the Section Access tab into the script.
3. The app now shows up in Section Access, ready for rules.

The Standard plan governs up to 10 apps. Only analytics apps can be provisioned: data scripts and data flows have no Section Access.

Attention: if the app already has Section Access applied from an earlier script, Qlik may deny editing the script. Reload the app once without the old block and try again.

Write the rules

Each row in the table is a rule with these columns:

Column	Meaning
ACCESS	ADMIN (sees everything) or USER (sees only what the row allows).
Email (USER.EMAIL) or IdP group (GROUP)	Who the rule applies to. Each row uses one of the two, never both.
Reduction fields (one column per field)	The value this person or group can see in each field (for example, the branch code). * allows every value listed in the table.
OMIT (hidden fields)	Fields the person does not see in the app, separated by commas.

Important rules:

• ACCESS and reduction field values are in uppercase;
• the group must be written exactly as in your identity provider (IdP), respecting upper and lower case;
• duplicate rules are rejected;
• the protected ADMIN row cannot be removed: it guarantees that someone can always open and configure the app.

Reduction field

Qlik’s Section Access reduces data by field name: each reduction column only works if it has exactly the same name as a field in the app’s data model. The default is a single field, CHAVE. Fields are under Reduction fields, right above the rules. Qovern suggests the field names it already knows from the app (from the generated documentation).

When one field isn’t enough, use Add field, up to 10. Each field becomes a column in the table, the file and the script. In the same rule, the fields apply together: with FILIAL = 10 and REGIAO = SUL, the person only sees what belongs to branch 10 and the South region. To allow every value of a field, use *. To give access to more than one combination, create one rule for each.

Fields are stored when you click Save and Apply Rules, together with the rules, and Qovern updates the Section Access tab in the app’s script. If it can’t, it tells you and doesn’t reload: fix what the message points out and click Save and Apply Rules again.

Import from a spreadsheet

For many rules at once, use Import spreadsheet in the rules editor.

1. Download the CSV or Excel template, or use your own spreadsheet with the columns ACCESS, USER.EMAIL or GROUP, one column for each reduction field (with the field name in the header) and OMIT.
2. Choose the file (.csv separated by comma, semicolon or tab, or .xlsx).
3. Check the preview: errors are shown per row.
4. Choose Add to the current rules (rules that already exist are skipped) or Replace the current rules (the protected ADMIN row is kept).

Importing only fills in the screen. Nothing goes to Qlik until you click Save and Apply Rules. For safety, cells that look like spreadsheet formulas (starting with =, @, + or -) are rejected. The limit is 5,000 rules per app.

Save and reload

The Save and Apply Rules button, at the end of the editor, does everything in sequence and stops at the first step that fails:

1. validates, stores a new version and publishes the file to Qlik (the result shows up under Publications);
2. inserts or updates the script in the app;
3. triggers the reload in Qlik and follows its status until it ends. Only one reload per app runs at a time.

Saved rules only take effect in the app after the reload.

File space

By default, the rules file is stored in the same space as the app. In the Section Access file space selector, on the app card, an administrator can choose another space. When it changes, Qovern rewrites the app’s script to read from the new space. The old file is not deleted from the previous space.

Qovern’s service account must be a member of the chosen space, with edit permission.

Script in the app

The block inserted into the script reads the published file and includes the rows Qovern needs to reload the app (the service account also gets an ADMIN row, because it is the one that triggers the reload). To see the block and a preview of the generated file, click SCRIPTS on the app card.

Qovern rewrites the block on every Save and Apply Rules, with the current reduction fields and space name. If the space is renamed in Qlik, just save again. If the app moves to another space, publishing is refused with a notice, and an administrator clicks Use the current Qlik space in that notice.

Rule history

The LOG button, on the app card, opens the app’s history in three tabs, newest first:

• Changes: which rules were added and removed in each save, and by whom;
• Publications: each version of the file, with its status and error, if any;
• Reloads: the reloads requested by Qovern and the ones run from Qlik.

On the Standard plan, the history shows the last 30 days.