Section Access

Section Access is Qlik’s row-level security: it decides which data each person sees inside an app. In Qovern, the rules live on their own screen, outside the load script, and every change is validated, published to Qlik and recorded in the audit trail.

How it works

1. You edit the app’s rules on the Section Access screen.
2. When you click Salvar regras (Save rules), Qovern validates everything, stores a new version and generates a CSV file.
3. The CSV is sent to the DataFiles connection of the app’s space in Qlik.
4. When you click Recarregar aplicativo (Reload app), Qovern asks Qlik to reload the app, and the new rules take effect.

The app’s script gets a Section Access tab that reads this file. You no longer need to edit the script to change who sees what.

Put an app under management

1. In Aplicativos (Apps), find the app and click Provisionar o Section Access (Provision Section Access).
2. Qovern creates the first rule, a protected ADMIN row for the app owner, and inserts the Section Access tab into the script.
3. The app now shows up in Section Access, ready for rules.

The Standard plan governs up to 10 apps. Only analytics apps can be provisioned: data scripts and data flows have no Section Access.

Attention: if the app already has Section Access applied from an earlier script, Qlik may deny editing the script. Reload the app once without the old block and try again.

Write the rules

Each row in the table is a rule with these columns:

Column	Meaning
ACCESS	ADMIN (sees everything) or USER (sees only what the row allows).
E-mail (USER.EMAIL) or Grupo do IdP (GROUP)	Who the rule applies to. Each row uses one of the two, never both.
Campo de redução (reduction field)	The value this person or group can see (for example, the branch code). * allows every value listed in the table.
OMIT (campos ocultos) (hidden fields)	Fields the person does not see in the app, separated by commas.

Important rules:

• ACCESS and reduction field values are in uppercase;
• the group must be written exactly as in your identity provider (IdP), respecting upper and lower case;
• duplicate rules are rejected;
• the protected ADMIN row cannot be removed: it guarantees that someone can always open and configure the app.

Reduction field

Qlik’s Section Access reduces data by field name: the reduction column only works if it has exactly the same name as a field in the app’s data model. The default is CHAVE, but you can change it on the app card, under Campo de redução. Qovern suggests the field names it already knows from the app (from the generated documentation).

Import from a spreadsheet

For many rules at once, use Importar planilha (Import spreadsheet) in the rules editor.

1. Download the CSV or Excel template, or use your own spreadsheet with the columns ACCESS, USER.EMAIL or GROUP, the reduction field and OMIT.
2. Choose the file (.csv separated by comma, semicolon or tab, or .xlsx).
3. Check the preview: errors are shown per row.
4. Choose Adicionar às regras atuais (Add to current rules; rules that already exist are skipped) or Substituir as regras atuais (Replace current rules; the protected ADMIN row is kept).

Importing only fills in the screen. Nothing goes to Qlik until you click Salvar regras. For safety, cells that look like spreadsheet formulas (starting with =, @, + or -) are rejected. The limit is 5,000 rules per app.

Save and reload

• Salvar regras validates, stores a new version and publishes the file to Qlik. The result shows up under Publicações (Publications).
• Recarregar aplicativo triggers the reload in Qlik and follows its status until it ends. Only one reload per app runs at a time.

Saved rules only take effect in the app after the reload.

File space

By default, the rules file is stored in the same space as the app. Under Espaço do arquivo (File space), on the app card, an administrator can choose another space. When it changes, Qovern rewrites the app’s script to read from the new space. The old file is not deleted from the previous space.

Qovern’s service account must be a member of the chosen space, with edit permission.

Script in the app

The block inserted into the script reads the published file and includes the rows Qovern needs to reload the app (the service account also gets an ADMIN row, because it is the one that triggers the reload). If the app moves to another space in Qlik, or the space is renamed, use Usar o espaço atual do Qlik (Use Qlik’s current space) or Inserir/atualizar script no app (Insert/update script in the app) on the app card.

Rule history

On the Auditoria recente (Recent audit) card, Ver histórico completo (See full history) opens three tabs:

• Alterações (Changes): which rules were added and removed in each save, and by whom;
• Publicações (Publications): each version of the file, with its status and error, if any;
• Cargas (Reloads): the reloads requested by Qovern and the ones run from Qlik.

On the Standard plan, the history shows the last 30 days.