Bigquery Row Level Security Filtered Data Viewer Governance

What the Filtered Data Viewer Role Is

The Filtered Data Viewer (roles/bigquery.filteredDataViewer) is a specialized, system-managed role in BigQuery designed strictly for row-level security access control. When a row access policy is created on a table, BigQuery automatically and implicitly grants this role to the principals specified in the policy definition.

How the Correct Approach Meets the Requirements

• Enforces Precise Boundary Isolation: Managing row access strictly through DDL statements ensures that each principal or group is bound solely to the specific predicate filter defined in their assigned policy.
• Prevents Over-Privileged Access: Because the role is not granted at the dataset or project scope, analysts cannot bypass policy filters or inherit permissions across other tables or policies in the dataset.
• Adheres to Principle of Least Privilege: Users are granted implicit access only to their filtered subset of data without receiving broader IAM permissions on the parent dataset.

Key Advantages

• Automatic Lifecycle Management: BigQuery automatically applies and revokes the system-managed role when policies are created, altered, or dropped via DDL.
• Eliminates Accidental Multi-Policy Unioning: Prevents users from inadvertently gaining access to the union of rows across every row-level access policy attached to resources within the dataset.
• Fine-Grained Governance: Provides exact auditability and deterministic SQL-level controls over sensitive rows.

Why This Is Optimal

Granting the role manually through IAM at the dataset or project level is a major security anti-pattern because it circumvents row filter scoping, allowing grantees to query data permitted across any row access policy in that resource scope. The optimal and supported method is to manage grantees strictly through SQL DDL CREATE ROW ACCESS POLICY ... ON table_name GRANT TO ('group:...') FILTER USING (...) statements.