The usual way to limit what someone sees is to give them their own extract. It works until there are forty extracts and nobody knows which one feeds which dashboard.

Rules where the data lives

Tessel passes each person’s identity to your warehouse and applies row rules there. A sales lead in Lisbon sees Iberian accounts; the finance team sees everything. Nothing is copied out.

Rules from your identity provider

Groups come from Okta, Google or Microsoft Entra through SCIM. When someone changes teams, their access changes with the group, not with a ticket.

Every query, export and shared link is written to the audit log with the rules that applied to it.