# User attributes

> Learn how to use User Attributes in Holistics to control data access with Dataset's Row-level Permission

## What is user attribute?
User Attributes are users' metadata that can be used by admins to control what data each user can access in Dataset's Row-level Permission.

Once defined, a User Attribute will be created globally for all Users and User Groups. These User Attribute values can be assigned to Dataset fields as filter values to restrict the data retrieved from that Dataset.

### Sample use cases of user attributes
**Row-level Permission control for Reporting (Datasets, Dashboards)**

Please navigate to **[Row Level Permission](/docs/access-control/row-level-permission)** to understand more on how it works.

**Row-level Permission using System Email**

In the following example, you have a data model that maps user's emails with data records you allow them to see.

Let's say each store manager has an account in Holistics. You can set up permission settings in your dataset to match `managers.manager_email` with the system attribute `h_email`, so each manager can only retrieve data from the stores that link to their `manager_id` when logging in to Holistics.

**Customize Dimension / Measure / Label each user can see**

You can add User Attributes into your expression to control data returned from queries.

Please navigate to **[Column Level Permission](/docs/access-control/column-level-permission)** to understand more on how it works.
```javascript
// AML
case(
	when: account_manager_email == H.current_user.h_email, then: customer_name,
  else: 'redacted'
)
```

**Filtering in Email Schedules**

For recipients who have Holistics accounts, you can also control what data they see by using User Attributes as filter values.

In the following example, each store manager has an account in Holistics (recipients), the scheduled email each manager receives will be filtered by the store they can access.

## Types of user attributes
There are two types of User Attributes.

- **System User Attributes**: These are predefined attributes by Holistics and cannot be modified.
- **Custom User Attributes**: These are admin-defined attributes to customize the experience for their users.

### System user attributes
System User Attributes are provided by Holistics, prefixed with `h_` and cannot be modified by any users.

Here is the list of System Attributes we currently support

- `h_email`: email of a user account
- `h_role`: role of a user account (admin, analyst, explorer, viewer)

Note: You cannot create custom User Attributes beginning with `h_` since this keyword is reserved for System Attributes.

### Custom user attributes
Holistics allows admins to add and manage custom attributes of other users for more flexible permission control. For example, you can create extra fields to control Dataset Permission such as `country_access`, `department`, etc.

:::note

- You cannot set User Attribute values for other admin users and admin users are not restricted by RLP.
- The default value of each User Attribute is **Inherit from groups.**
:::

## Manage user attributes
To view and manage User Attributes of a User, visit the [User Management](/docs/admin/manage-users) page, and then select **Attributes** in the actions panel of a user you want to view. The **Edit User Attribute values** modal will appear, and you can view, add, or edit the values of each User Attribute.

### Add new user attributes
To create a new attribute, click **Add or manage User Attributes** button at the bottom left of the User Attributes modal. The **User Attributes Management** will appear, and here you can add new User Attributes that are applicable to all Users and User Groups in the system.

Here are settings for each User Attribute:

- **Name**: must be standardized and unique within an organization's scope, as this will be used across Holistics AML. **Attribute's name can only contain lowercase letters, numbers, underscores, and cannot start with a number.**
- **Label**: a user-friendly way to display the Attribute name.
- **Type**: Currently there are four types: Text, TrueFalse, Number, Date. These types need to match with Dataset's field types in **[Row-level Permission](/docs/access-control/row-level-permission).**
    - **Text**: To specify an array of string values, for example, Country, Department...
    - **TrueFalse**: To specify `f` for false value, `t` for true value
    - **Number**: To specify an array of number values, for example, User ID, Store ID...
    - **Date:** To specify a date or date range

### Edit user attributes values
After setting up User Attributes, you can set values of each User Attribute in **Edit User Attributes values** view.

There are 3 input types: **Inherit from Groups, Manual Input, All.**

:::info
- When setting User Attribute values for **a specific User**, choosing any type other than **Inherit from Groups** means **overriding Group values**.
:::

#### Inherit from Groups

**Inherit from Groups** combines all the attribute values of all the Groups a user belongs to. This is the default type of all User Attributes. If the user doesn't belong to any group, the value will be empty.

For example, you have a User Attribute `country` and a list of Europe managers. Instead of adding each country in Europe to each manager's `country`, you can create a group called `Europe` which its `country` attribute contains all the countries in Europe, and add all managers to that group.

#### Manual Input

Manual Input allows you to manually set the values of an Attribute for the User.

:::info
- You can only input the values whose types match the type of their corresponding User Attribute.
- Empty value means the User doesn't have any values for this Attribute.
:::

#### All

If you want to get all available values of a Dataset's field, you can leverage the **ALL** input type. With this type, the user will not be restricted by permission controls tied to that Attribute.

For instance, if you have a CEO who manage all merchants and department of all countries, you only need to change his User Attribute's values to **All**.

### Delete user attributes

You can only delete a User Attribute if it is not used anywhere in Holistics. Click **Add or manage Attributes** to open **User Attributes management** modal and click **Delete** to remove the User Attribute you no longer need.

:::info
- The attribute will be deleted for **all Users and Groups** .
- Delete action cannot be undone.
- If an attribute has been used in Dataset Permission Settings, you need to delete that permission rule first.
:::