Cube implements visibility and access controls for every entity of its data modeling layer, be it a cube, a view, a measure, or a dimension. You’re in charge of what is surfaced and available via APIs to any actor, be it a user, a role, or an application.

With its elaborate multitenancy configuration, Cube ensures that each tenant of your data application (such as a user, an account, or an organization) has their unique view of the data in the semantic layer and can access only their data.

Whether you’d like to restrict access at the row level, mask or hide certain columns, or enforce granular access based on user or application roles, Cube supports everything and then some. You have ultimate flexibility to implement a security model that works for your use case since you can intercept, inspect, and allow or disallow any query to your semantic layer.

Every query to the semantic layer is augmented with a security context that includes permission claims, passed as industry-standard securely signed JSON Web Tokens. Should you require a custom authentication protocol, you can override the default implementation with what works best for your use case.

If an external authentication service such as Auth0 or AWS Cognito is part of your stack, you can connect them to Cube with readily available JSON Key Sets integration.