# Capabilities, permission templates and Allow, Deny, None

*Tableau Server Administrator Study Guide · Install & Configure · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-server-administrator/install-and-configure/capabilities-permission-templates-and-allow-deny-none*

How Tableau Server builds a permission from capabilities, templates and rules, how Allowed, Denied and Unspecified are evaluated against site roles, ownership and group membership, and what permission design means for copying rules, access requests, project moves and private collections.

- Certification: Salesforce Tableau Server Administrator
- Exam section: Install & Configure
- Study guide: https://www.certifyforce.com/study-guide/tableau-server-administrator

**Official exam objective:**

> 2.5 Permissions: 2.5.1 Understand: 2.5.1.1 System permission composition, 2.5.1.2 The ramifications of permission design, 2.5.1.3 The Tableau Security Model; 2.5.2 Describe the differences between Allow v. Deny v. None.

## What the exam expects

- Pick the workbook or data source capability that matches a requested action (filtering, comments, image, summary or full data, connecting, downloading, overwriting).
- Predict what each template (None, View, Explore, Publish, Administer, Denied) sets and what it leaves Unspecified.
- Evaluate Allowed, Denied and Unspecified across site role, ownership, user rules and group rules.
- Explain the Tableau security model: authorization by site role plus asset-based permissions on existing users, groups and content.
- Anticipate the ramifications of permission design: copied rules, access requests, project moves and private collections.

Key terms: **capability** (one action, such as Filter or Connect, on one kind of content); **permission rule** (a row setting each capability for one group or user on one asset); **template** (a preset that sets a group of capabilities to Allowed); **Unspecified** (no setting; denied unless another rule allows it); **effective permissions** (the final result for one user).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Permissions | Asset-based and implicitly denied | [Authorization](https://help.tableau.com/current/server/en-us/security_authorize.htm) |
| Inheritance | Only in locked projects and tabbed-view workbooks | [Authorization](https://help.tableau.com/current/server/en-us/security_authorize.htm) |
| Template applied | Its capabilities Allowed, the rest Unspecified | [Permission Capabilities and Templates](https://help.tableau.com/current/server/en-us/permissions_capabilities.htm) |
| None vs Denied template | All Unspecified vs all Denied | [Permission Capabilities and Templates](https://help.tableau.com/current/server/en-us/permissions_capabilities.htm) |
| Download Image/PDF | PNG, PDF or PowerPoint | [Permission Capabilities and Templates](https://help.tableau.com/current/server/en-us/permissions_capabilities.htm) |
| Workbook-only capabilities | Overwrite, Download Workbook/Save a Copy, Move | [Permission Capabilities and Templates](https://help.tableau.com/current/server/en-us/permissions_capabilities.htm) |
| Group conflict | Any group Deny beats a group Allow | [Effective permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm) |
| Rule targets | Only existing users, groups and assets | [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm) |
| Locked-project access request | Goes to the project owner | [Let Site Users Request Access to Content](https://help.tableau.com/current/server/en-us/Request_access.htm) |
| Move into customizable project | Explicit leaders kept, inherited leaders removed | [Add Projects and Move Content Into Them](https://help.tableau.com/current/server/en-us/projects_add.htm) |
| Private collection | No permission rules; owner and administrators still see it | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |

## Check yourself

- What does each click on a capability square set, in order?
- When does permission inheritance exist in Tableau Server?
- When does the Save button in the permissions dialog read Delete Rule?

## Sources

- [Permission Capabilities and Templates](https://help.tableau.com/current/server/en-us/permissions_capabilities.htm)
- [Effective permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm)
- [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm)
- [Authorization](https://help.tableau.com/current/server/en-us/security_authorize.htm)
- [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm)
- [Add Projects and Move Content Into Them](https://help.tableau.com/current/server/en-us/projects_add.htm)
- [Let Site Users Request Access to Content](https://help.tableau.com/current/server/en-us/Request_access.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 16 linked practice questions, and unlimited timed mock exams are included with the Tableau Server Administrator pack (USD $19): https://www.certifyforce.com/practice-exams