Published at: 2026-09-17
Overview
Learn the full picture of the BI platform’s permission system and its control chain.
Business Value
BI permission management is the core foundation for protecting enterprise data security. With a well-designed permission configuration, you make sure employees in different roles see the right charts and access data within the appropriate scope. This enables refined, data-driven operations.
Permission Categories at a Glance
The BI platform’s permission system covers four dimensions:
Functional Permissions
Control BI menu visibility and chart operations. A three-level chain (role > subject domain > chart level) determines which menus users see and which operations they can perform on charts. Menu visibility is computed dynamically from the user’s permission status:
| Menu | Visibility Condition |
|---|---|
| Reports | At least one visible chart |
| Dashboard | Visible to all users |
| Subscription Management | Subscription permission in at least one subject domain |
| Report Permission Management | Create permission in at least one subject domain |
| Report Logs | Visible only to report admins and CRM admins |
| Statistical Indicator Management | Visible only to report admins and CRM admins |
| Goals | View list permission on the Goal Value object |
| Goal Completion | Visible whenever the Goals menu is visible |
Dashboard Permissions
Control the creation, editing, viewing, and authorization of dashboards. Dashboard permissions have two layers: backend operation permissions (view/create/edit/delete) and page visibility permissions (public/private).
Object and Field Permissions
Inherited from CRM business permissions. These determine which objects and fields users can see in charts. Whatever object and field permissions you have in CRM, you have the same permissions in BI.
Data Permissions
Inherited from CRM data permissions. These determine the range of data rows visible in charts. Scopes include Owned by Me, owned by my subordinates, owned by departments I manage, shared with me, and All.
Permission Control Chain
Role
└→ Functional permissions (menus and chart operations)
├→ Subject domain permissions (coarse-grained: view/create/edit/delete/export/subscribe/share/forward)
└→ Chart-level permissions (fine-grained: public/private)
└→ Dashboard permissions
├→ Backend operation permissions (view/create/edit/delete)
└→ Page visibility permissions (public/private)
└→ Object permissions (inherited from CRM business object permissions)
└→ Data permissions (inherited from CRM data permissions)
├→ General subjects: consistent with object list data
└→ Special subjects: personnel, department, and account pool have their own rules
Applicable Roles
| Role | Main Operations |
|---|---|
| CRM admin | Configure all permission types |
| Report admin | Configure BI functional permissions and data permissions |
| Department head | View data within their managed scope and manage subordinate permissions |
| Regular employee | Use BI to view and analyze data according to assigned permissions |
Core Terms
Subject Domain
An analytical domain built around a core object, such as account analysis, opportunity analysis, or payment analysis. The subject domain is the basic control unit of BI functional permissions. Every chart belongs to a specific subject domain. The operation permissions you have in a subject domain set the maximum range of operations on its charts.
Chart-Level Permissions
A finer-grained permission control applied to an individual chart on top of subject domain permissions:
- Public: Everyone with view permission on the subject domain can view the chart.
- Private: Only the selected personnel, departments, department heads, user groups, or roles can view the chart.
Preset Reports
Out-of-the-box charts preset by the system. Visible to all employees, such as the charts in preset homepage modules and preset dashboards. Distinct from charts created by users themselves.
Statistical Indicator Management
A module for managing chart subjects and indicators. It includes operation permissions such as view, create, edit, delete, enable, and disable.
Data Permission Scopes
| Scope | Description |
|---|---|
| Owned by Me | Data owned by the current user |
| Owned by My Subordinates | Data owned by the current user’s subordinates |
| Owned by Departments I Manage | Data whose assigned department is a department managed by the current user or its sub-departments |
| Shared With Me | Data granted to the current user through permission sharing |
| All | All of the above scopes |
Dashboard Types
| Type | Creator | Data Permissions |
|---|---|---|
| Personal | Roles with create permission in the backend | Uses the viewer’s personal data permissions |
| Enterprise | Only CRM admins and report admins | Uses the grantor’s data permissions |
Core Objects and Related Objects
- Core object: The subject object being analyzed. Data permissions match the CRM business list.
- Related object: Other objects related to the core object. Their data is visible in the chart, but clicking View Details applies the related object’s own data permissions.
Interconnection Scenario
A scenario where an upstream enterprise (such as a brand owner) assigns BI charts to downstream enterprises (such as distributors) for viewing. Permissions convert automatically between upstream and downstream: object permissions follow the downstream role settings, and data permissions switch to the downstream identity automatically.
Recent Updates
2026-07-22
- Initialized the BI permission management documentation set.