---
title: "About Dimension replacement in access rights rules"
slug: "about-dimension-replacement-access-rights-rules"
description: "Optimize access rights with Dimension replacement to enhance security, improve performance, and simplify management in complex datasets."
tags: ["Access Rights", "Data Management", "Security and Permissions ", "Security Model"]
updated: 2025-06-18T14:00:15Z
published: 2025-08-22T11:22:15Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.pigment.com/llms.txt
> Use this file to discover all available pages before exploring further.

# About Dimension replacement in access rights rules

When you’re working with large datasets or complex models, it's critical to simplify and optimize access rights wherever possible. **Dimension replacement**enhances manageability and user experience of your security model while also improving performance.

## Before you begin

### Why apply Dimension replacement in access rights?

The benefits include:

- Reduces the number of access rights Metrics you need to create and maintain.
- Speeds up access rights recalculation and improves model loading time.
- Simplifies security model structure.
- Increases flexibility when working with complex data.

Performance gains are especially significant when replacing a Dimension containing *few* items (like Region) with one that has *many* items (like Country or Employee).

Dimension replacement supports both hierarchical and custom relationships, allowing you to manage access rights in a more scalable way.

### Use Cases for Dimension replacement in access rights rules

1. **Supply Chain Management**:
  - Restrict access to specific regions or product categories within a global supply chain model.
  - Map warehouses to delivery zones to ensure users only access relevant information.
2. **Financial Models**:
  - Assign access based on organizational structures, such as departments linked to budget categories.
  - Grant access to country-specific financial data for regional managers without exposing unrelated regions.
3. **Human Resources**:
  - Connect employee roles to their specific access requirements, such as linking job titles to sensitive salary data.
  - Map teams to projects so users only see relevant task details.

## How does it work?

### **Example 1: Region to Country**

You have Dimensions for **Region** and **Country**, with each Country linked to a Region via a List Property. You want to apply access rights at the Region level and have them cascade to Countries.

**Without Dimension replacement:**

1. Create an access rights Metric for `User x Region`.
2. Create another Metric for `User x Country`, with a formula referencing `User x Region` via the mapping.

![](https://uploads-eu-west-1.insided.com/pigment-en/attachment/135cb03c-2984-48d1-8d5d-6d7f766a9ce3.gif)

**With Dimension replacement:**

You define access rights on `User x Region`, and Pigment applies them to `User x Country` using the mapping relationship between Country and Region.

![](https://uploads-eu-west-1.insided.com/pigment-en/attachment/b55318f5-7baf-4b9b-a701-b53fdf66be2e.gif)

### **Example 2: Business Unit to Employee and Month**

Each employee belongs to a **Business Unit**, which may change over time. You track these changes using a mapping Metric with Dimensions `Employee x Month` and values for Business Unit.

You want to apply access rights defined at the **Business Unit** level and apply them to `Employee x Month`**.**

**Without Dimension replacement:**

1. Create an access rights Metric for `User x Business Unit`.
2. Create a Metric for `User x Employee x Month` with a formula pulling in access from `User x Business Unit` via the mapping.

![](https://uploads-eu-west-1.insided.com/pigment-en/attachment/5b233700-eada-46cc-ae17-219071214a25.gif)

**With Dimension replacement:**

You use just the `User x Business Unit` Metric and apply it to `Employee x Month` through the replacement feature. This eliminates the need to compute a much larger access rights Metric.

> [!WARNING]
> ⚠️ Important
> 
> The **mapping Metric must be stored in the Security folder**in order to use it for Dimension replacement.

![](https://uploads-eu-west-1.insided.com/pigment-en/attachment/37e1a5a1-e887-4327-905a-fcc16fb99e0a.gif)

> [!TIP]
> 🎓 **Resources**
> 
> For a demonstration of the examples above, see [this video on YouTube](https://youtu.be/6tC4hE-U0EI).

## Performance Impact

By reusing a single access rights Metric across multiple Dimensions, you:

- Avoid computing high-cardinality access rights Metrics.
- Reduce the total cell count in your access model.
- Improve model load times and access rights recalculation speed—especially when the replaced Dimension has many items.

In the Business Unit / Employee / Month example:

- **10s of Business Units**
- **100s of Months**
- **1000s of Employees**

This would require a massive access rights Metric, unless you use Dimension replacement. **The result?** Faster model performance and leaner security configurations.