One report, each region sees its own

Build a single report and let row policies show each regional manager their own numbers, in Halo Data or in your own app with signed embeds.

A sales director wants one report for five regional managers. Without row policies, that means five copies to keep in step, and a real chance of someone opening the wrong one.

The question

How is my region doing? Each manager asks the same thing and sees the same layout, with their own numbers. The director and head office see them all.

The data you need

A table with a column that says which region each row belongs to:

• a date, revenue and orders

• a Region column, with values such as North, South, East, West and Central

The values have to match what you give each person exactly, so check them on the dataset's Explore tab. If regions are codes, that's fine: use the codes.

The dataset

Build a dataset as usual, then add the rule. Row policies live on the dataset, so every chart and report built on it follows them.

Say who sees what

You have two ways to tie a person to a region:

With an attribute:

1. In Settings, Members, under User attributes, press New attribute. Name it Regions, with the key regions, and press Add attribute.

2. Open each manager's page and set their values, such as North, or North and East.

With groups: in Settings, Groups, make one group per region, named exactly as the values in your data. See Invite and manage members.

Add the policy

On the dataset's Access tab, under Row policies, press Add policy:

1. Field: Region.

2. Rows where it: is one of.

3. Their: Regions, or Groups, by name.

4. Doesn't apply to: roles and groups that see every row. New policies leave out Owners and Admins. Add a Head office group here so the director's team sees everything.

Save the dataset. Someone with no values for the attribute sees no rows, which is the safe way to fail.

Check it

Under Preview as a member, pick a manager and press Explore as to see the dataset with the rows they see. Do this before you tell anyone. See Row policies.

The charts

Build charts without thinking about regions. A chart by region shows one bar to a North manager and five to the director.

What the director sees. A manager covering North and East sees those two bars.

The same table for everyone, showing only the rows they may see, with totals to match.

A manager's totals add up to their own rows, so nobody can work out another region by subtraction.

The report

Make one report, with no region filter, and publish it. Put it in a workspace everyone can find (Who can find it: The organization), since a Viewer can read it there.

To keep it from the rest of the organization, put it in a private workspace instead and share it with the managers' groups. Either way, the row policy separates the numbers.

How it's shared

The rule follows the data wherever the report goes:

With members, in Halo Data

Everyone opens the same link and sees their own rows. So do Halo AI and members' own AI tools, which query as the person asking. If the rules change, conversations that used the old ones stop.

By scheduled email

A scheduled email to Members and groups goes out as each person sees it, so one schedule sends five different PDFs. Addresses outside Halo see what a public link shows: no rows from this dataset.

In your own app, with signed embeds

If your managers already sign in to your portal, you don't need to add them to Halo. Your server signs a short-lived token for each one, naming the report and their attributes. Halo opens the report with those values, as if the reader had them.

{
  "report": "<report id>",
  "attributes": { "regions": ["North", "East"] },
  "iat": 1762140000,
  "exp": 1762143600
}

Set up the secret in Settings, Embedding, list your site under Sites it may be embedded on in the report's share dialog, and sign tokens on your server only. Tokens last at most 24 hours, and an hour is plenty. Signed embeds always read live data. See Signed embeds.

What not to do

• Don't use a public link for this. A public reader has no attributes, so datasets with row policies show no rows.

• Don't rely on an unlocked report filter. It only shapes what the page shows: readers can change it, and a request to the API can leave it out. Row policies apply to every query, underneath any filter. Locked filters hold too, on top of the policy, but a report's is the same for everyone, so it can't show each region its own.

• Don't forget exports. Row policies apply to exports too, so that's one less thing to check.