# User filters, data policies and database RLS compared

*Tableau Consultant Study Guide · Plan and Prepare Data Connections · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/tableau-consultant/plan-and-prepare-data-connections/user-filters-data-policies-and-database-rls-compared*

Choose a row-level security approach from Tableau's decision flow: manual and dynamic user filters, data policies on virtual connections, and RLS already built into the database through impersonation, Kerberos delegation or Initial SQL, with the licence, permission and connection trade-offs of each.

- Certification: Salesforce Tableau Consultant
- Exam section: Plan and Prepare Data Connections
- Study guide: https://www.certifyforce.com/study-guide/tableau-consultant

**Official exam objective:**

> Compare RLS approaches.

## What the exam expects

- Walk Tableau's row-level security decision flow: existing database RLS, then Data Management, then proof of concept or static audience, otherwise a dynamic user filter.
- Compare manual and dynamic user filters on maintenance, data requirements and the permissions that keep them secure.
- Explain how data policies on virtual connections centralize RLS, how they interact with permissions and the Connect capability, and where they stop applying (flow output, extracts built downstream).
- Weigh database RLS (impersonation, Kerberos delegation, Initial SQL) against its requirements: live connections, database users for every viewer, dedicated connections, Active Directory.
- Pick the approach for OLAP cubes and for external audiences who have no database or domain account.

Key terms:
- **Manual user filter:** a set that maps named users or groups to field values, created with Server > Create User Filter.
- **Dynamic user filter:** a calculated field that compares a security column in the data with a user function.
- **Data policy:** a policy on virtual connection tables whose policy condition is evaluated for every row at query time.
- **Connect capability:** the virtual connection permission that lets a user query it and build content on its tables.
- **Database RLS:** security already enforced by the database, which Tableau reuses by querying as the viewer.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Decision flow order | Database RLS, Data Management, POC or static, then dynamic filter | [RLS options overview](https://help.tableau.com/current/server/en-us/rls_options_overview.htm) |
| Data policy scope | Workbooks, data sources and flows using the connection; live and extract | [Virtual connections overview](https://help.tableau.com/current/server/en-us/dm_vconn_overview.htm) |
| Flow output | Not filtered by the data policy | [Virtual connections overview](https://help.tableau.com/current/server/en-us/dm_vconn_overview.htm) |
| Querying a virtual connection | Requires the Connect capability; policies don't override permissions | [Virtual connections overview](https://help.tableau.com/current/server/en-us/dm_vconn_overview.htm) |
| Database RLS | Live connections only; likely unavailable on Tableau Cloud | [Database RLS](https://help.tableau.com/current/server/en-us/rls_datasource.htm) |
| Impersonation | SQL Server 2005 or newer; individual accounts, not AD groups | [Impersonation requirements](https://help.tableau.com/current/server/en-us/impers_requ.htm) |
| Kerberos delegation | AD identity store, domain-joined server, viewer credentials | [Kerberos delegation](https://help.tableau.com/current/server/en-us/kerberos_delegation.htm) |
| OLAP cubes | No data source filter, no USERNAME() | [Database RLS](https://help.tableau.com/current/server/en-us/rls_datasource.htm) |
| Bridge | Doesn't support SQL impersonation using Initial SQL | [Database RLS](https://help.tableau.com/current/server/en-us/rls_datasource.htm) |

## Check yourself

- Why might a data policy's entitlement table live in a different database from the tables it secures?
- When does Kerberos delegation fall back to the Run As account during web authoring?
- Why should an Initial SQL RLS data source be published rather than embedded?
- Which function categories can a data policy condition use?

## Sources

- [Overview of Row-Level Security Options in Tableau](https://help.tableau.com/current/server/en-us/rls_options_overview.htm)
- [About Virtual Connections and Data Policies](https://help.tableau.com/current/server/en-us/dm_vconn_overview.htm)
- [Row-Level Security in the Database](https://help.tableau.com/current/server/en-us/rls_datasource.htm)
- [RLS Best Practices for Data Sources and Workbooks](https://help.tableau.com/current/server/en-us/rls_bestpractices.htm)
- [Create a Data Policy for Row-Level Security](https://help.tableau.com/current/server/en-us/dm_vconn_create_rlspolicy.htm)
- [Create a User Filter and Secure it for Publishing](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters_create.htm)
- [Impersonation Requirements](https://help.tableau.com/current/server/en-us/impers_requ.htm)
- [Enable Kerberos Delegation](https://help.tableau.com/current/server/en-us/kerberos_delegation.htm)
- [License Data Management](https://help.tableau.com/current/server/en-us/dm_license.htm)
- [Schedule Extract Refreshes for a Virtual Connection](https://help.tableau.com/current/server/en-us/dm_vconn_extract.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 8 linked practice questions, and unlimited timed mock exams are included with the Tableau Consultant pack (USD $19): https://www.certifyforce.com/practice-exams