Capabilities, permission templates and Allow, Deny, None
How Tableau Server builds a permission from capabilities, templates and rules, how Allowed, Denied and Unspecified are evaluated against site roles, ownership and group membership, and what permission design means for copying rules, access requests, project moves and private collections.
2.5 Permissions: 2.5.1 Understand: 2.5.1.1 System permission composition, 2.5.1.2 The ramifications of permission design, 2.5.1.3 The Tableau Security Model; 2.5.2 Describe the differences between Allow v. Deny v. None.
~6 min read · 16 practice questions
What the exam expects
- Pick the workbook or data source capability that matches a requested action (filtering, comments, image, summary or full data, connecting, downloading, overwriting).
- Predict what each template (None, View, Explore, Publish, Administer, Denied) sets and what it leaves Unspecified.
- Evaluate Allowed, Denied and Unspecified across site role, ownership, user rules and group rules.
- Explain the Tableau security model: authorization by site role plus asset-based permissions on existing users, groups and content.
- Anticipate the ramifications of permission design: copied rules, access requests, project moves and private collections.
Key terms: capability (one action, such as Filter or Connect, on one kind of content); permission rule (a row setting each capability for one group or user on one asset); template (a preset that sets a group of capabilities to Allowed); Unspecified (no setting; denied unless another rule allows it); effective permissions (the final result for one user).
Key facts
- Detail
- Asset-based and implicitly denied
- Detail
- Only in locked projects and tabbed-view workbooks
- Detail
- Its capabilities Allowed, the rest Unspecified
- Detail
- All Unspecified vs all Denied
- Detail
- PNG, PDF or PowerPoint
- Detail
- Overwrite, Download Workbook/Save a Copy, Move
- Detail
- Any group Deny beats a group Allow
- Detail
- Only existing users, groups and assets
- Detail
- Goes to the project owner
- Detail
- Explicit leaders kept, inherited leaders removed
- Detail
- No permission rules; owner and administrators still see it
Sources for this section (7)
- Authorizationhelp.tableau.com (opens in a new tab)
- Permission Capabilities and Templateshelp.tableau.com (opens in a new tab)
- Effective permissionshelp.tableau.com (opens in a new tab)
- Permissionshelp.tableau.com (opens in a new tab)
- Let Site Users Request Access to Contenthelp.tableau.com (opens in a new tab)
- Add Projects and Move Content Into Themhelp.tableau.com (opens in a new tab)
- Manage Permissions with Projectshelp.tableau.com (opens in a new tab)
- What does each click on a capability square set, in order?
- When does permission inheritance exist in Tableau Server?
- When does the Save button in the permissions dialog read Delete Rule?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Tableau Server Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 34 lessons of the Tableau Server Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (16 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both