Access Preview answers one question: given this role, in this organization, what can the user actually reach? It resolves capabilities and data scope together and shows the result, so permission errors surface in the admin panel rather than in a support ticket.
New in v2.0.0. Sidebar location: Access Control → Access Preview. The page itself renders under the heading Effective Access Preview — same screen.
Authorization in CYPEX v2.0.0 is two-dimensional, and both dimensions must agree before a row is returned:
- Capability — what operations a role may perform (SELECT / INSERT / UPDATE / DELETE / EXECUTE), granted through PostgreSQL roles.
- Data Scope — which organization’s rows that role can see, enforced by Row-Level Security.
Neither screen alone tells you the outcome. A role’s Capabilities tab shows grants but not which tenant’s rows they apply to. A role’s Organizations tab shows data scope but not which operations are permitted. Access Preview is where the two are combined. See Capabilities vs data scope for the underlying model.
WarningAccess Preview reflects capability and data scope. It does not override Schema Access. If an organization has not been granted a schema, nothing in that schema is reachable regardless of what the role can do. Check Schema Access first when a result looks impossible.
The page is driven by three controls at the top:
| Control | What it does |
|---|---|
| Role filter | Select the PostgreSQL role to resolve. Most sections stay empty until a role is chosen. |
| Organization filter | Select the tenant context. For an Organization Administrator the list is restricted to their mapped organizations by the backend, not by the UI. |
| Search | Free-text filter across apps, queries, functions, and workflows. |
Results are grouped into four collapsible sections, each with a count:
| Section | What it shows |
|---|---|
| Apps | Applications owned by the selected role and organization. Each entry links to its editor. |
| Queries | Queries (database views) with per-operation permissions — SELECT, INSERT, UPDATE, DELETE — for the selected role. |
| Functions | Database functions (stored procedures) and whether the role holds EXECUTE. |
| State Transitions | Workflow transitions the role may perform, grouped by object. Each entry links to its Workflow Builder. |
Run this after configuring roles, organizations, and Schema Access, and before handing an environment to users.
- Open Access Control → Access Preview.
- Select the role you want to verify. Start with the least-privileged role that must still get work done — over-privileged roles rarely produce the failure you are looking for.
- Select the organization that role is expected to operate in.
- Expand Queries and confirm the operations match intent. A role that should write but shows SELECT only will fail at runtime with an empty result or a permission error, not with a helpful message.
- Expand Apps and confirm the applications the role should reach are listed.
- Repeat for each role/organization pair you support.
TipDo this before generating applications. CYPEX renders an application against what its owner user can see, so a misconfigured role produces a misconfigured application — and regenerating is more work than fixing the role first.
| Symptom | What to check |
|---|---|
| Every section is empty | No role selected, or the role has no organization mapping. Check the role’s Organizations tab under Roles & Capabilities. |
| Queries listed, but the user still sees no rows | Data scope is missing or wrong. The role can run SELECT and gets zero rows. Check the organization mapping and the JWT org_id claim. |
| Nothing at all in a whole schema | Schema Access. The organization has not been granted that module. See Schema Access. |
| User can read but not write | Expected for Organization Member on CYPEX core tables — that role type is SELECT-oriented, with full CRUD retained only where users own the content (reports, files, notifications). |
| An Organization Administrator sees fewer organizations than expected | Correct behaviour. The organization list is server-scoped to their mappings. |
For the recorded evidence behind a specific decision — who saw what, and why —
query cypex_log.t_permission_audit_log. See
Governance evidence.
The legacy label was “Effective Access”. The sidebar entry is now Access Preview — action-oriented and matching the operator workflow: pick a role, preview what it reaches. The page heading still reads Effective Access Preview; both refer to this screen.
- Roles & Capabilities — role types, capabilities, and organization assignment.
- Organizations — the multi-tenant data boundary.
- Schema Access — which schemas an organization may use.
- Capabilities vs data scope — the conceptual model.
- Users — assigning roles and organizations to people.