--- title: "Permissions-aware data filtering" description: "Filter data according to user access privileges when fetching records from the data storage." canonical: "https://www.cerbos.dev/features-benefits-and-use-cases/permission-aware-data-filtering" source: "https://www.cerbos.dev/features-benefits-and-use-cases/permission-aware-data-filtering" --- # Permissions-aware data filtering Filter data according to user access privileges when fetching records from the data storage. ## What is permissions-aware data filtering? Permissions-aware data filtering is the process of fetching data based on a principal's access level. Instead of retrieving all the data and then filtering out unauthorized content, this approach fetches only the data the principal is allowed to access, ensuring efficiency and enhanced security. Based on the access policies, Cerbos provides a list of conditions to apply in your data query, in order to only fetch the correct data points. ### Permissions-aware data filtering with Cerbos Use the Cerbos query plan to dynamically filter data retrieval according to your authorization policies. Based on the access policies, Cerbos provides a list of conditions to apply in your data query, in order to only fetch the correct data points. - **Efficient retrieval:** Fetch only the necessary data, reducing the load on your databases and ensuring faster response times. - **Enhanced security:** By only retrieving allowed data, you minimize the risk of accidental data leaks or exposure. - **Dynamic adjustments:** As authorization policy changes, the filtering logic adjusts in real-time, ensuring up-to-date access control. - **Seamless integration:** Cerbos' query plans can be mapped into your existing data fetching layer. Alternatively, use reference one of Cerbos' implementations for [Prisma](https://cerbos.dev/ecosystem/cerbos-prisma), [SQLAlchemy](https://cerbos.dev/ecosystem/cerbos-sqlalchemy), [Mongoose](https://cerbos.dev/ecosystem/cerbos-mongoose). Policies can be consistently applied across various layers of the technology stack: - **Data Layer:** Controlling access to raw data in databases and data warehouses. - **API Layer:** Enforcing permissions for data accessed programmatically. - **Application Layer:** Enforcing access controls within software applications. - **AI Layer:** Ensuring AI agents and chatbots respect user permissions. ## Mastering permissions-aware data filtering - [Data filtering documentation](https://docs.cerbos.dev/cerbos/latest/api/index.html#resources-query-plan) — Dive deep into the mechanics of setting up and optimizing data filtering with Cerbos - [Data filtering guide](https://www.cerbos.dev/blog/filtering-data-using-authorization-logic) — Unlock the full potential of data filtering with these tips - [Data filtering for RAG and LLMs](https://docs.cerbos.dev/cerbos/latest/recipes/ai/rag-authorization/) — Apply data filtering to your RAG architecture to place guardrails around your LLMs. - [Fine-grained control for embedded policy bundles with ePDP Rules](https://www.cerbos.dev/blog/epdp-rules-fine-grained-control-for-embedded-policy-bundles) — A new way to configure exactly what policies are served to which clients, with enterprise-grade security built in. - [The Cerbos ecosystem](https://www.cerbos.dev/features-benefits-and-use-cases/ecosystem) — Find out more about ORMs - [Community insights on permissions-aware data filtering](https://community.cerbos.dev/?_gl=1*5ozo82*_ga*MTk1NjcwNzQ1MC4xNjY2Mjc5NjI2*_ga_8G3G3MS838*MTY5NDE5MTE5Ny41MjcuMS4xNjk0MTkyNzgyLjIwLjAuMA) — Engage with the Cerbos community to share experiences and learn from real-world implementations