RLS does not apply when creating a chart directly from SQL Lab without first saving the query as a dataset.

[Yassuip]

Bug description

Issue Summary
When querying a dataset with Row-Level Security (RLS) applied in SQL Lab, the results are correctly filtered. However, if I click "Create Chart" directly from SQL Lab (without saving the dataset/virtual dataset), the chart displays the entire unfiltered data, ignoring the RLS restrictions. Ideally, it should only show the filtered data returned in SQL Lab.
We can clearly see that SQL Lab returns only 3 rows — as expected. However, on the chart screen, it displays 125 rows, which is incorrect and indicates that the RLS filter is not being applied.

Expected Behavior:
The chart should reflect only the filtered results returned by SQL Lab (i.e., RLS-applied data).

📷 Evidence:
SQL Lab Data Records(RLS)

Chart Screen Data Records

Steps to Reproduce:

• Query a dataset with RLS in SQL Lab.
• Verify that RLS filters are applied (returns limited rows).
• Click "Create Chart" directly from SQL Lab.
• Observe that the chart ignores RLS and shows all rows.

Notes:
This seems to be due to the chart being created from a raw SQL result, which doesn't preserve RLS constraints unless it's saved as a dataset or virtual dataset.

Screenshots/recordings

No response

Superset version

4.1.2

Python version

3.10

Node version

16

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

The issue you're experiencing is related to how Apache Superset handles Row-Level Security (RLS) when creating charts directly from SQL Lab. When you create a chart directly from SQL Lab without saving the query as a dataset, the RLS filters are not applied. This is because the chart creation process from SQL Lab does not automatically incorporate RLS constraints unless the query is saved as a dataset or virtual dataset first.

In Superset, RLS is typically applied when queries are executed within SQL Lab, and the results are correctly filtered. However, when transitioning directly to chart creation from SQL Lab, the RLS predicates are not automatically included in the chart's data source unless the query is saved as a dataset. This behavior is due to the way Superset handles data sources for charts, which requires the dataset to be explicitly defined with RLS constraints.

To ensure that RLS is applied when creating charts, you should save the SQL Lab query as a dataset first. This will preserve the RLS constraints and ensure that the chart reflects the filtered data as expected.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[suryanshpratap825]

Yes, this happens because RLS isn't applied when creating a chart directly from SQL Lab unless the query is saved as a dataset. Saving it first is a good workaround for now.

[Yassuip]

@suryanshpratap825 Do we have any specific permission that can hide the "Create Chart" button or disable the related API? Since that option allows users to access the entire dataset, it could potentially expose all data.

[suryanshpratap825]

@Yassuip , I found these two link it will helps you out to achevie it.

#28760

https://stackoverflow.com/questions/68478219/restrict-access-to-a-table-in-sql-lab-in-superset#:~:text=If%20you%20give%20access%20to,and%20query%20from%20that%20dataset.

[rusackas]

If anyone wants to add some clarity here in the docs, that would be SO VERY welcome :D

Is that answer sufficient to close the issue for now?

[Yassuip]

If RLS is not supported when creating charts from raw SQL queries, then allowing users to build charts without first saving the dataset poses a potential data security risk. Currently, I haven't found any permission setting that restricts this behavior—aside from completely removing SQL Lab or dataset access. If RLS can't be enforced in this flow, there should be a built-in mechanism to disable chart creation from raw queries to prevent unintended data exposure.
Given this, we should treat the ability to bypass RLS as a data exposure issue and consider implementing a fix. Ideally, RLS should be enforced even for raw queries, especially since SQL Lab itself applies RLS when returning raw query results. And a user clicks “Create Chart” from the same SQL Lab screen, the chart should be based on the already-filtered data—not the full underlying dataset.