# Project permissions, locking and content access strategy

*Tableau Consultant Study Guide · Establish Governance and Support Published Content · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/tableau-consultant/establish-governance-and-support-published-content/project-permissions-locking-and-content-access-strategy*

Secure content with group rules on locked projects: how effective permissions are evaluated, what locking and changing project rules do, the Default project and All Users, project leaders and owners, why hidden sheets are not security, and how workbook access to a published data source is checked.

- Certification: Salesforce Tableau Consultant
- Exam section: Establish Governance and Support Published Content
- Study guide: https://www.certifyforce.com/study-guide/tableau-consultant

**Official exam objective:**

> Recommend a strategy for securing access to content.

## What the exam expects

- Predict a user's effective permission from site role, ownership or project leadership, user rules and group rules.
- Choose locked or customizable asset permissions, and predict what changing project rules or the lock setting does to existing content.
- Clean up the Default project and the All Users group so new projects start without broad access.
- Delegate content administration to project leaders and owners without granting site settings.
- Reject hidden sheets as a security control, and pick Prompt users or Embed password for a workbook's access to a published data source.

Key terms:
- **Capability:** the ability to perform one action on content, such as View, Download Full Data or Set Permissions; each is Allowed, Denied or Unspecified in a rule.
- **Effective permission:** what a user can actually do after site role, user scenarios and every rule are evaluated.
- **Asset permissions:** the project setting, Locked or Customizable, that decides whether project rules are enforced on content.
- **Project leader:** a user given their maximum site-role capabilities for a project hierarchy, without site or server settings.
- **Default project:** the template every new top-level project copies its permission rules from.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Unspecified capability | Results in denied | [Effective permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm) |
| Allow and Deny in two groups | Deny takes precedence | [Effective permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm) |
| Content owner in a locked project | All capabilities except Set Permissions | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |
| Customizable to Locked | Overwrites custom content rules; can't be undone | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |
| New top-level project | Copies Default project rules; Asset permissions start Customizable | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |
| Who creates top-level projects | Administrators only | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |
| Removing project leader | Rule left with all capabilities Unspecified | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |
| All Users group | Delete its rule or set it to None | [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm) |
| Hidden sheets | Reachable with Download Workbook/Save a Copy | [Publish a Workbook](https://help.tableau.com/current/pro/desktop/en-us/publish_workbooks_howto.htm) |
| Embed password to a published data source | Viewers see data with the author's access | [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm) |
| Collections | Their permissions don't change the content's permissions | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |

## Check yourself

- Why does moving a workbook into a locked project change its permissions?
- When a collection is shared, why might two users see different item counts?
- Which special project can't be deleted, moved or renamed?
- Why can a user see a view whose workbook and project they cannot view?

## Sources

- [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm)
- [Effective permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm)
- [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm)
- [Permission Capabilities and Templates](https://help.tableau.com/current/server/en-us/permissions_capabilities.htm)
- [Use Projects to Manage Content Access](https://help.tableau.com/current/server/en-us/projects.htm)
- [Governance in Tableau](https://help.tableau.com/current/blueprint/en-us/bp_governance_in_tableau.htm)
- [Publish a Workbook](https://help.tableau.com/current/pro/desktop/en-us/publish_workbooks_howto.htm)
- [Data Security](https://help.tableau.com/current/server/en-us/security_data.htm)
- [Authentication and Authorization](https://help.tableau.com/current/blueprint/en-us/bp_authentication_authorization.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 8 linked practice questions, and unlimited timed mock exams are included with the Tableau Consultant pack (USD $19): https://www.certifyforce.com/practice-exams