The Learning Dashboard Query That Never Reaches the Database

The Learning Dashboard Query That Never Reaches the Database

Imagine a bank manager asking an AI-built academy dashboard to compare training completion across their cohorts. The generated query omits the tenant restriction and joins private assessment notes. The manager may open the dashboard, but that does not authorize every query it generates. Hiding the notes after fetching them would put the security decision too late.

The resource becomes the enforcement boundary

Retool’s 22 October 2026 announcement describes Data Access Enforcement in public beta for Enterprise organizations using Postgres. Policies sit on the resource and apply across apps, workflows and agents, subject to execution-path limits. Enabling enforcement closes access until active policies grant it.

This is a hypothetical reference architecture, not a claim that App-Learning uses Retool’s beta. Its value for multi-tenant learning analytics is the separation of stable data permissions from changing reporting interfaces.

Four checks precede the data query

Retool’s enforcement model checks access before execution and blocks queries it cannot evaluate. It governs the Retool connection, not independent database connections or PostgreSQL grants. Applied to the academy, the contract would cover four dimensions.

• Identity establishes the signed-in user behind the query.
• Table grants permit completion records, not unrelated personnel tables.
• Column grants permit required fields, not private assessment notes.
• Row filters restrict records to the authorized tenant and cohorts.

In this design, selecting an ungranted notes column rejects the query before execution. Omitting a tenant condition does not necessarily reject it; enforced row filters narrow the permitted results. LMS analytics permissions belong in that contract, not the AI prompt. A row-level security dashboard still needs table and column controls.

Roles define different evidence boundaries

The hypothetical academy would use these read-only reporting boundaries.

• Managers see necessary completion fields for their tenant and assigned cohorts.
• Training admins see learner identifiers, course status and completion dates within their assigned tenant.
• HR sees designated tenant-scoped summary tables without learner-level drilldown, with separately designed small-group suppression.
• Agents act within a specific signed-in user’s grants; unattended analytics without an attributable identity stop.

Retool’s setup guide warns that grants are additive, so a broad Full access policy can defeat narrower rules. It also requires prepared statements and warns against connection-pooling proxies. AI agent access control therefore needs configuration review, not just prompt review.

Background reporting needs a separate design

Retool’s troubleshooting documentation identifies blocked public and embedded apps and identity-less scheduled or webhook workflow runs. Self-hosted deployments currently block every workflow query against enforced resources. Other workflow blocks may still complete, making partial failure an operational risk.

The documented workflow workaround uses a separate, unenforced resource with dedicated database credentials and restricted use. Those queries do not inherit the enforced resource’s policies. For an overnight academy report, that path needs its own narrowly scoped database permissions.

Acceptance testing includes intentional denial

1. Test missing identities and attributes, cross-tenant requests and ungranted columns in joins or filters.
2. Verify denied queries return no protected payload and allowed queries retain correct row scope.
3. Test overlapping roles, schema changes, exports and background jobs in each deployment environment.

For App-Learning, role- and tenant-scoped analytics should be a B2B trust requirement. A bank needs evidence of capability growth without turning every generated dashboard into a new authorization project. The interface can change quickly. The boundary around learner data should remain explicit, testable and independent.