Best Of

To start, I think this forum should be a place for open discussion, not surveys. I'm not going to use the Smartsheet form. Let's talk here.

And when I say "us," I'm referring to the community.

For the past few months, I've mostly stayed silent on the forum. During that time, I've watched the discussions decline and the questions become less frequent, while the forum has increasingly started to feel like a request site rather than a place for conversation. I'd like to see if we can change that.

Whether you're a Domo Coach, a longtime contributor, or hiding behind User_XXXX, I'd genuinely like to hear your voice—not an echo of mine. After this post, I intend to go back to being a mostly silent participant and let the community take the conversation wherever it goes.

With that said, I'll start.

I personally don't use PDP in Domo, even though controlling data access by user is a primary need for our company. When I initially set up our environment, I evaluated PDP and ultimately recommended that we use a different approach for our external users.

Sorry Dan, but I'm probably not the PDP success story you were hoping to hear from.

—

I want to start with something more fundamental than PDP itself.

When a customer tells you that a feature is confusing, difficult to administer, and ultimately something they have chosen not to use, I don't think the right starting point for the product manager is to explain why the implementation is actually good.

That's not a neutral position from which to evaluate the product. It immediately puts us into a discussion where I have to convince you that there is a problem before we can even discuss how to solve it.

If the goal is genuinely to improve Domo, I think the more useful question is:

Why did a customer who has a very obvious need for this feature decide it was easier not to use it?

Our use case could hardly be simpler.

Imagine a company with 100 locations. Employees at Location 17 should see Location 17's data. Someone responsible for Locations 17, 18, and 19 should see those three locations. Someone at the corporate level may need to see everything.

That's not an unusual or complicated permissions problem.

From our perspective, Domo took that very simple business rule and turned it into a much more complicated system of PDP policies, datasets, groups, permissions, exceptions, and administrative rules that we have to understand and maintain.

The problem isn't that PDP can't technically accomplish this.

The problem is that Domo made us think about security in Domo's terms instead of our business's terms.

I shouldn't have to think:

"What PDP policies does this user need on these datasets?"

I should be able to tell Domo:

"John belongs to Location 17."

That's the business rule.

Domo should take care of translating that business rule into the appropriate data restrictions.

If John moves from Location 17 to Location 22, I should change 17 to 22 in one place. I shouldn't have to think about every dataset, dashboard, policy, group, or other place where that change might have consequences.

That's what makes PDP frustrating to us (me). The administrative model doesn't correspond naturally to the way organizations actually work.

And with security, complexity isn't merely an inconvenience.

Complexity creates risk.

If a dashboard is difficult to build, someone gets annoyed.

If a security model is difficult to understand, someone can see data they aren't supposed to see.

So I think the standard for a permissions system should be unusually high. An administrator should be able to answer two questions immediately:

What can this user see?

Why can they see it?

If answering either question requires tracing policies across datasets, groups, roles, and exceptions, then I would argue the permissions system has failed an important usability test, regardless of how technically capable it may be.

That's why I wouldn't begin the conversation by defending PDP. I'd begin by asking why customers with an extremely straightforward need for row-level security can look at PDP and conclude that the safer and easier option is simply not to use it.

To me, that's the product problem worth solving.