Data Access Control
Learn what Data Access Control (DAC) is, how its permission settings work, and the access levels you can assign to each user role and table.
What You'll Learn
This article explains what Data Access Control (DAC) is and how its permission model works. You'll learn how Owned By and All Other Records settings work together, and what each access level allows.
What Data Access Control Does
Data Access Control (DAC) adds centralized, data-layer security to tables in your Knack app. Instead of managing permissions only at the page level, you enforce security rules directly on your tables. Knack applies these rules automatically across every page, element, search, API endpoint, and data export, so you don't have to recreate the same restrictions in multiple places.
AvailabilityData Access Control is available on newly created apps today. Starting in August 2026, Knack is rolling out support for existing apps too. See the Data Access Control Frequently Asked Questions for details.
Data Access vs. Page Access
Page Access controls which pages a user role can reach. Data Access controls what records a user can see and do once they're on a page, in a search, or through the API. The two work together. A role can have access to a page but still be limited in which records it can view or edit on that page.
How Permission Settings Work
You configure DAC permissions at the User Role level, for every table in your app. For each role and table pair, you set two things:
- "Owned By" User: controls what a user can do with records they created or are assigned to. See Understanding the Owned By Field for more on how this works with DAC.
- All Other Records: controls what a user can do with records that belong to someone else.
Access Levels
Each setting above can be set to one of these access levels:
| Access Level | Allowed Operations | Available For |
|---|---|---|
| Full Access | Create, edit, view, and delete records. | Owned By and All Other Records |
| Edit Only | Create, edit, and view records. Can't delete. | Owned By and All Other Records |
| View Only | View records only. | Owned By and All Other Records |
| No Access | Can't view or interact with records. | All Other Records only |
Owned records always have some accessLive App users always retain some level of access to records they own. You can't set No Access on the Owned By User setting.
Where DAC Rules Apply
Once enforced, Data Access rules apply consistently across your entire app: Classic and Next Gen Live Apps, pages, elements, inline edits, modals, searches, API requests, and data exports. This eliminates the risk of a security gap from a page-level permission you forgot to set.
Common Mistakes
- Assuming Page Access alone secures your data. Page Access only controls navigation. Without Data Access rules in place and enforced, a user with page access can still see or edit records you didn't intend them to.
- Expecting No Access to work on Owned By. No Access is only available for All Other Records. A user always has at least some access to records they own.
Next Steps
- Understanding the Owned By Field: Learn how record ownership is determined before you configure the Owned By setting.
- Setting Up and Enforcing Data Access Control: Walk through configuring the Data Access grid and turning on enforcement.
- How Data Access Control Enforcement Works in the Live App and API: See exactly what happens when a user hits a restricted action.
Updated 7 days ago