# ABAC JWT migration guide

> For the complete documentation index, see [llms.txt](https://developers.thoughtspot.com/docs/llms.txt)

Source: https://developers.thoughtspot.com/docs/jwt-abac-migration-guide

# ABAC JWT migration guide

Administrators can migrate their existing implementation of ABAC with JSON Web Token (JWT) to the new [ABAC via RLS]({{navprefix}}/{{abac_rls-variables}}) model, where:

-   Row-level security (RLS) rules are defined in ThoughtSpot on tables and data models
    
-   JWTs only provide values for variables used in those RLS rules, instead of sending full filter rules.
    

## Supported migration paths

-   [From legacy ABAC implementation with "filter\_rules" to ABAC via RLS]({{navprefix}}/{{abac-migration-from-jwt-ga}})
    
-   [From JWT ABAC beta implementation to ABAC via RLS]({{navprefix}}/{{abac-migration-from-jwt-beta}})
    

## Important notes and considerations

Review the information in the following sections before getting started with the migration.

### ABAC feature support

The legacy JWT ABAC implementation methods will be deprecated and removed in a future version. The legacy methods will not receive new enhancements or workflow improvements. Therefore, we recommend migrating your existing deployments to [ABAC via RLS]({{navprefix}}/{{abac_rls-variables}}) and testing the rollout before the legacy implementation options are removed from ThoughtSpot.

### Persistence behavior

ABAC via RLS does not support session-based ABAC rules (`"persist_option": "NONE"`). If your implementation currently relies on session-based rules:

-   Create dedicated user accounts for your application users. You can use REST APIs to automate user creation, update, or deletion.
    
-   Apply persisted security rules to those users.
    
-   Use cookieless authentication with these persisted users.
    

This approach addresses all use cases that previously relied on session-based JWT and ensures Liveboard schedule attachments enforce security rules and deliver only secured output to your end users.

### Table joins

The filters in JWT ABAC Beta implementation respect `MODEL JOINS`. However, RLS by default is an `INNER` join. If you want to adjust behavior for your implementation, contact ThoughtSpot Support.

## Next steps

Choose the migration path that best suits your current implementation and complete the migration steps. Refer to the following guides for migration and rollout instructions:

-   [Migration guide for JWT ABAC implementation with filter\_rules]({{navprefix}}/{{abac-migration-from-jwt-ga}})
    
-   [Migration guide for JWT ABAC Beta implementation]({{navprefix}}/{{abac-migration-from-jwt-beta}})
    

## Additional resources

-   For information about JWT with custom variables and RLS rules, see [ABAC via RLS rules]({{navprefix}}/{{abac_rls-variables}}).
    
-   For information about RLS, see [RLS Rules]({{navprefix}}/{{rls-rules}}) and [ThoughtSpot Product Documentation](https://docs.thoughtspot.com/cloud/latest/security-rls).