So bit of an explanation here, with the tl;dr of the question at the bottom.
My organization has a web application that stores and tracks records for users. We've been using SSRS for our reports so far, which are integrated into our application. One of the security modules we have in place is user-based. Each user, and each record, has an access level. If the user's access level is lower than the record's, they can't see it. We have a similar setting for restricting user access by their organization relative to the record's. When pulling an SSRS report, our users are able to pass parameters through our application interface to the report, and we also automatically pass the user's organization profile and access level to ensure they are only retrieving records they're authorized to view.
My higher-ups are quite insistent on migrating everything over to Power BI. Problem is, I've found no way to automatically pass parameters to the report on generation. There is no way to pass that required access level to the report prior to retrieving the data. My understanding is that Power BI Embedded may have a feature like this, but since it utilizes an hourly, metered connection for its model, my employers are not willing to entertain that as an option.
So I'm looking into row-level security instead. Is there a way to utilize RLS to restrict what results a user can view, based on one of the column values that is being returned? And assuming that's possible, is it possible to do this securely? My understanding is that we'd have to have our clients' administrators set up the user roles and assign them in Power BI. Is there a way to prevent users from simply changing their own roles, and viewing records they don't have access to?
