Row-level data scope
All / department / department and below / self only / custom, injected uniformly by the data access layer.
The scopes
| Scope | Meaning | Typical user |
|---|---|---|
| All | ignores data boundaries | system administrator |
| Department | data of the current department only | department head |
| Department and below | the department and its children | manager in a multi-level org |
| Self only | only own data | regular member |
| Custom | a specified set of departments | cross-department roles |
Where it is injected
Scope conditions are injected uniformly by the data access layer; business code is unaware and never hand-writes the check. That is the fundamental difference from "an if in every service", which will always miss one.
Hand-written SQL: what to watch
- Statements that use the framework query capabilities get scope conditions automatically.
- Hand-written XML is not covered by automatic injection; add scope and soft-delete conditions yourself.
- For multi-table joins use the sort-key allowlist; never concatenate an unvalidated sort string.
How to debug
- First confirm with a high-privilege account that the data exists, ruling out a query-condition problem.
- Then check the data scope bound to that account's role.
- Finally check whether this query went through hand-written SQL.
Last updated 2026-10-09Edit this page →