# Bug 3178: cell level read permissions

- Status: open
- Project: Zero
- Creator: @tantaman
- Labels: schema
- Created: 2024-12-02T18:11:19Z
- Modified: 2026-08-15T22:05:50Z
- Reactions: ⬆️ ×30 (AceroM, Antonio-Bennett, KidkArolis, MarkLyck, Mat4m0, MatejFrnka, MrPorky, RaeesBhatti, aboodman, alamothe, anaydotdev, austinm911, carlosbensant, celeron450, elledienne, erikmunson, ictnmd, izakfilmalter, jackfraser70, mukama, natew, neoantox, quick007, rohitpaulk, samohovets, snehalbaghel, sonercirit, svetch, tmm, vaughanlove) · 😿 ×1 (sonercirit) · 🙏 ×15 (Antonio-Bennett, Mat4m0, MatejFrnka, RaeesBhatti, aboodman, alamothe, carlosbensant, ictnmd, izakfilmalter, mugoosse, quick007, saibotma, samohovets, sonercirit, vaughanlove)
- URL: https://bugs.rocicorp.dev/p/zero/issue/3178

## Description

We need some way to implement "cell-level permissions". e.g., imagine a `user.phone_number` column. The user should be able to read it, and perhaps their administrator. But other users should not.

This can be worked around currently by factoring the private columns into a separate table, e.g., `user_private`. Then, ZQL can be used to control access to that entire row. But it would be nice to have a solution that didn't require refactoring the schema.

## Comments (4)

### @izakfilmalter — 2025-05-12T11:28:50Z

Would love this for my user object. I am using better-auth so I am kinda stuck with their schema form a table pov. I don't want users to be able to mutate them selves into being an admin.

Reactions: ⬆️ ×4 (MarkLyck, RaeesBhatti, amerkestijn, saibotma) · 👆️ ×1 (MarkLyck) · 💯 ×1 (MarkLyck)

### @aboodman — 2026-02-10T17:56:51Z

Note: Izaks comment is now out of date. With custom mutators (default as of Zero 0.25) you can control exactly what is *editable*. Just not what is readable.

Reactions: 👍️ ×1 (rohitpaulk)

### @rohitpaulk — 2026-06-13T14:52:38Z

With queries, can't you control what is readable too since they're validated on the server?

### @MatejFrnka — 2026-07-24T21:18:26Z

I would love to be able to control which columns are synced in queries. 

This is a must have feature for my usecase where I must not sync columns like phone numbers for some users based on their roles.

I would be able to solve this by defining queries with different subsets of columns returned.