How does permissions-aware reporting work in Impact Hub?
Note: This feature is rolling out in waves
Permissions-aware reporting is available to organizations that:
-
Use Apricot Role-Based Permissions (legacy permissions are not eligible)
-
Access Impact Hub in the United States
-
Have been migrated to the updated Apricot permissions architecture
If your organization has been migrated, your Apricot administrator will receive a notification in Apricot. We're aiming to complete migrations for all eligible organizations by late October.
Once your organization is migrated, permissions-aware reporting applies to new data standard datasets created after your migration date. It does not apply to existing datasets. As more Apricot data sources become available in Impact Hub, permissions-aware reporting will extend to those as well.
Overview
Permissions-aware reporting ensures that Impact Hub datasets created from Apricot data standards automatically reflect each user's Role-Based Permissions in Apricot. Users see only the data they're authorized to access — making reporting more secure, consistent, and easier to manage.
How it works
When a user accesses an internal use dataset in Impact Hub, the system automatically filters data based on their assigned access in Apricot. No additional configuration is needed in Impact Hub.
Access is enforced at the following levels:
-
Site and program access
-
Form and record-level access
-
Caseload-based restrictions
Field-level permissions are not supported at this time.
What users experience
For organizations on Role-Based Permissions, users see only the records they're authorized to access in Apricot. Permissions behave consistently across Apricot and Impact Hub reporting, and no additional setup is required.
For organizations on legacy permissions, granular filtering does not apply. All users with access to a dataset will see all included data, the same view as an Apricot administrator. Reporting access remains at the dataset level, not the user level.
Supported datasets
Permissions-aware reporting applies to single-organization internal use datasets — specifically, datasets created from Apricot data standards where "Internal Use" is selected during the data standard setup process.
It does not apply to:
-
Datasets created before this feature was available to your organization
-
Network (multi-organization) datasets, which continue to follow existing organization- or network-level access rules
How permissions stay in sync
Permissions are inherited directly from Apricot. When changes are made to Role-Based Permissions in Apricot, those changes are reflected in Impact Hub datasets within 24 hours.
Troubleshooting
Before reaching out to Support, run through these checks.
Before making changes
-
Is your organization using Apricot Role-Based Permissions? This feature requires Role-Based Permissions to enable granular access.
-
Has your organization been migrated to the updated Apricot permissions architecture? If your organization has been migrated, your Apricot administrator will receive a notification in Apricot. We're aiming to complete migrations for all eligible organizations by late October.
-
Are you working with a single-organization internal use dataset? Permissions-aware reporting does not apply to network datasets.
-
Does the user have the correct role assignments in Apricot? Verify site, program, and caseload access.
After making changes
-
Does the report show only the records each user is authorized to access? If not, confirm the organization is using Role-Based Permissions.
-
Are all users seeing the same data? Confirm the organization is on Role-Based Permissions and is working with an internal use dataset.
-
Did you refresh the report after updating permissions? Some changes require a refresh to take effect.
-
Has enough time passed for permissions to sync? Changes can take up to 24 hours to reflect in Impact Hub.
Why can some users see all records in Impact Hub reports and others cannot? | How do Apricot permissions work in Impact Hub? | How do I limit what data users can see in Impact Hub? | Does Impact Hub use Apricot Role-Based Permissions? | Why are my Impact Hub reports showing different data for different users? | How do I know if my organization has been migrated to the updated Apricot permissions? | Do legacy permissions work with permissions-aware reporting? | How long does it take for Apricot permission changes to show in Impact Hub? | Why does a user see all the data in an Impact Hub dataset? | Does permissions-aware reporting work with network datasets or existing datasets?