For an RLS-enforced model where reports need fastest performance, where should RLS rules be applied?

• A. Apply Rules to Dimension Tables
• B. Apply Rules to Hierarchies
• C. Apply Rules to Fact Tables
• D. Apply Rules to Measures

Answer: (A)

Row-level security works by restricting which rows a user can see. For fastest performance, place the filters on the dimension tables. Dimension tables are smaller and sit at the start of the relationships to logic in the model. When you apply RLS there, the engine can propagate the filter through the relationships to the related fact data, pruning the large fact table early and reducing how many rows must be scanned and joined. This pushdown leads to much quicker queries than filtering on the larger fact table itself, or trying to apply security at the measure level (which doesn’t filter rows) or on a hierarchy alone (which is still rooted in the dimension data).