How do you implement row-level security?

In Power BI Desktop, Modeling → Manage roles, then define a DAX filter on a table. After publishing, assign users or security groups to the role in the Service.

For dynamic RLS, create an entitlement table mapping user UPNs to the entities they may see, relate it to your dimension, and filter with [email] = USERPRINCIPALNAME(). One role then covers every user and access changes become data edits.

Test as a Viewer — workspace Admins and Members bypass RLS on datasets they can edit. Always test a user with no entitlements; an empty report is the correct result.