Field-level permissions lets you give your team access to Deel Analytics reports and dashboards while controlling exactly which data each person can see.
Admins decide access by data object (like People or Invoices) or by individual field (like First name or a custom field). Anyone without access to a field never sees its values.
Before You Begin
You must be:
- An Org Admin, or a user who can create custom roles
How field-level permissions work
Field-level permissions build on custom roles. You create a role, set what it can do in Analytics & Reports 2.0, and then choose which data it can see.
Step 1 – Access Roles and Permissions
- Navigate to Organization settings and access the Roles and Permissions card.
- Select the Roles tab and click on Create Role.
Step 2 – Create a Custom Role
- Create your own custom role.
- Define the role's access scope.
Step 3 – Pick an access level
- In the role's Analytics & Reports 2.0 permission, choose View only or Build and share.
- Use these options to control access by data model and field.
Step 4 – Choose data models
- Turn access on or off for a whole model, such as People, Contracts, or Invoices.
Step 5 – Fine-tune by field
- Within a data model, allow or block specific fields, including custom fields.
Step 6 – Assign the role
- Assign the role to users. Anyone with that role sees only the data you allowed.
Restrictions apply everywhere data appears: report tables, charts, dashboards, and drill-downs into the records behind a chart or measure. Restricted values aren't returned to the report or dashboard at all.
Caution: "View all" and "Build and share all" give a role access to all fields, with no restrictions. Sensitive data, such as compensation, becomes visible.
Important: Choose them only for people who should see everything. To restrict data, use View only or Build and share.
What each role can see
| Role | What they can do | What they see |
|---|---|---|
| Build and Share All | Full access to build and share all data in Analytics | All data |
| View All | Full access to view all Analytics | All data shared with them |
| Build and Share | Create, edit, and share reports and dashboards | Only the objects and fields allowed for their role. Templates and data outside their access stay hidden. |
| View Only | Open reports and dashboards shared with them | Only the objects and fields allowed for their role. |
For example, a payroll analyst's role allows access to view Invoices data but blocks salary fields in People. Their reports show invoice data, and salary values never appear, even in a drill-down.
Set up field-level permissions in four steps
- List who needs what. Group your team by the data they need, such as finance, IT, or HR operations.
- Create a custom role for each group and give it Analytics and Reports access (View Only, or Build and Share).
- Select the data objects and fields the role can see. Leave sensitive fields, such as compensation, switched off.
- Assign the role to your team members, then open a report as one of them to confirm the result.
Frequently Asked Questions
Do restrictions apply to dashboards and drill-downs?
Yes. Reports, dashboards, and drill-downs all respect the same field-level rules.
Can I restrict custom fields?
Yes. You can choose which custom fields a role can see.
Can I control access to a whole data object at once?
Yes. Turn an object on or off for a role, or choose individual fields inside it.
What happens if someone opens a report with fields they can't access?
They see only the data their role allows. Restricted values aren't shown.