Are there any workarounds to hide certain data from Looker Admins (or nearly admins) while keeping them ‘sudo’ option for most of the models and ‘role adjustment’ option as part of their access? We use SAML SSO for our general connection to Looker, but for this specific data we implemented OAuth as an additional login step (as we use BigQuery and we setup limitations in there for certain tables by using Google distribution lists). Yet we need to limit the option of reaching specific models in Looker via ‘sudo’ or data from specific tables in BigQuery while still being able to use the ‘sudo’ option in general & administer roles.
To the best of my knowledge, the only limitation applied to sudo is that non-admin users can only sudo as other non-admin users.
So I’d guess the only way to prevent your non-admin sudoers from seeing specific data is by making sure that only admins could access that data. That is, don’t grant permission to explore/view that model set to any non-admin user.
Thanks a lot for your feedback, Sam!
However, the goal here is to give a specific group of non-tech employees access to a particular dataset. Since they won’t be involved in Looker administration, we want to avoid giving them broader permissions than they need (by making them admins). Therefore we are trying to find a way to grant them access to that one dataset while restricting it from everyone else, including the sudoers.