RLS security in chained datasets

[speedramps]

How do you apply RLS (role level security) security across a "chained" datasets?

In Power BI it is possible to “chain” datasets. These chains can be viewed in lineage option.

These lineage flows operates form left to right. (see digaram)

If a dataset on the left has RLS (Role Level Security) rules. How can those RLS rules be inherited by a dataset on the right.

Here is an example:-

I create a dataset  “Sales” in import mode called with 1 table with 3 columns (country, product, amount) with RLS (role level security on country) to split US and China sales. I publish it to Power BI service and it works perfectly.

I create a dataset in import mode called “China tax” with 1 table with 2 columns (product, tax). I publish it to Power BI service and it works perfectly.

I then create a dataset called “Chained”. I get data from the “Sales” and “China tax” dataset. This creates a chain using direct query. I then add a relationship by product.

I want to be ceratin that if I add a dataset in a chain, that users further down the chain can't bypass the earlier RLS.
For example if a user only has access to China in the Sales dataset, then they should only see China in the Chained dataset.

What is happening, is that the “Managed Role”, “Views as” and “Test as role” buttons are greyed out in the Chained dataset.

I want to be ceratin that if I add a dataset in a chain, that users further down the chain can't bypass the earlier RLS.

Is it possible to define RLS once on a dataset and then inherit these rules in a chain?

What is the best practice for RLS in chained datasets?

Please can fellow super users help me. Thank you:-
@Ashish_Mathur 
@lbendlin
@Greg_Deckler

[speedramps]

Thank Ibendlin. That is the behaviour that I was expecting.
However, what is happening, is that the “Managed Role”, “Views as” and “Test as role” buttons are greyed out in the Chained dataset. So I can't test that the roles in the first dataset are being applied to the next dataset in the chain.

There is very little microsoft documentation or examples of RLS in a chain datasets.

[lbendlin]

Fair point. You have to take the results of the chained dataset RLS laying down. You cannot test these unless you have access to that workspace, and you cannot test roles from different datasets at the same time. It's either or .

[lbendlin]

RLS (role level security)

That's not what RLS stands for...

Think of RLS across chained dataset like filters that are applied on top of each other.  You can take away more rows but you cannot modify what has already been taken away.