When defining a Data Security Rule, the Term value is matched against the unique key of the object's records. Only records whose unique key matches the term are accessible to the user.

Wildcards and special terms can be used to make rules more flexible.

​

The only supported wildcard character is *, which represents one or more unspecified characters.

Wildcards can appear multiple times in a single term. Using a wildcard-based rule means that new records whose keys match the pattern are automatically accessible to the role without needing to update the rule.

​

Some objects use a unique key made up of more than one attribute. When this is the case, the term must include an expression for each attribute in the key, separated by a double colon:

Attribute1::Attribute2::Attribute3

For example:

EMEA-*::*::*

This matches records where the first attribute of the key starts with EMEA-, and any value for the second and third attributes. Every attribute in the unique key must be represented in the term.

​

To use * as a literal character rather than a wildcard, escape it with a backslash:

\*

For example, price\** matches records whose unique key starts with the literal text price*.

​

Wildcard matching is supported for attributes of type String, Text, and Reference. It cannot be applied to date attributes. If the unique key includes a date attribute, that attribute must be represented with an exact value in the term — wildcards are not valid for date portions of a key.

​

​

Allows access to records where a reference attribute in the unique key has no value. Without this term, records with empty reference values would be excluded.

​

Allows access to all records for an object that has data security enabled. Using EU_ALL in a rule has the same effect as disabling data security on that object for the role.