---
schema_version: "1"
id: fc403584e4940ef0913c470f8e9fac6fc32e7db341db8c287ecc49223b9d406d
title: Data Governance and Sharing in Tableau Next
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/analytics/264-0-0/tua_governance.md
canonical_url: https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 8cd92c30f142a468c7cb89991b4755f463db8e576b934098abe4ef2ad9a5a247
description: Tableau Next has a multi-layered access control structure powered by flexible Salesforce permission sets, Data 360 governance policies, and sharing settings on each Tableau Next asset.
products:
- Tableau Next
release: "264"
---
# Data Governance and Sharing in Tableau Next
Tableau Next has a multi-layered access control structure powered by flexible Salesforce permission sets, Data 360 governance policies, and sharing settings on each Tableau Next asset.
### Required Editions
1. **[Foundational Access - Licenses and Permissions](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5 "Licenses grant access to Data 360 and Tableau Next. Permissions grant access to data spaces and their contents.")**
- [Tableau Next Licenses](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5 "Licenses control users’ potential access.")
- [Tableau Next Permission Sets](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5 "Permission sets (standard or custom) control baseline functional capabilities such as access to Concierge, asset editing, and personal orgs.")
2. **[Data Visibility - Policies](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5 "Policies allow and deny access to Data 360 objects (like DLOs, DMOs, and CIs) and records and also mask fields within data spaces. They can be widely applied with minimal data preparation and are implemented differently than security in Tableau or CRM Analytics.")**
- [Data 360 Policies in Tableau Next](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5 "Data 360 controls data access centrally, through policies defined in Data Governance. In contrast, CRM Analytics defines data access at the dataset level and record-level security in Tableau is driven by the data source.")
- [Data Source Record-Level Security](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5 "Configure record-level security differently depending on the data source.")
- [Allow Policy Patterns in Tableau Next](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5 "Policy criteria can be layered and mixed to achieve your desired data visibility results. Here are some common policy structures.")
- [RLS with Entitlement Tables](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5 "To control record-level security for zero-copy DLOs, connect an entitlement table that describes user-level record access and define an allow policy with it. Upload a CSV file and create a filtered join in the policy.")
3. **[Asset Access - Sharing](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5 "Sharing an asset within Tableau Next grants another user visibility and capabilities related to that asset. Sharing doesn’t override policy-based restrictions.")**
## Foundational Access - Licenses and Permissions
Licenses grant access to Data 360 and Tableau Next. Permissions grant access to data spaces and their contents.
A Salesforce Administrator can [Assign a User a Tableau Next Permission Set](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_assign_tableau_permset_to_users.htm&release=264.0.0&type=5 "Assign permissions to users based on their level of interaction with Tableau Next capabilities. Users must already be created in Salesforce. You can’t add users in the Tableau Next app. Each Tableau Next permission set that you assign to a user consumes a license. You can view your license status as you assign permission sets."). Choose the best [Tableau Next Permission Sets and Licenses](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_permsets_licenses.htm&release=264.0.0&type=5 "Each user that interacts with Tableau Next requires a license and a permission set. Each Tableau Next license maps to one or more standard permission sets that allow different levels of interaction with Tableau Next capabilities.") based on a user’s needed capabilities.
## Tableau Next Licenses
Licenses control users’ potential access.
Note If you’re familiar with Tableau, these are similar to site licenses.
### Tableau Next Creator, Tableau Next Creator (Legacy)
These licenses contain everything in Tableau Next, including assigning permission sets to users, tracking license usage, and viewing metadata for all assets Tableau Next.
### Tableau Next Consumer, Tableau Next Consumer (Legacy)
These licenses include view access to Tableau Next assets, as well as creating and following metrics.
### Tableau Next Limited Consumer
This license includes view access to assets in Tableau Next Apps for Salesforce.
### Tableau Next Included App
This license includes manage access to template framework templates and apps, and view access to assets created from templates.
## Tableau Next Permission Sets
Permission sets (standard or custom) control baseline functional capabilities such as access to Concierge, asset editing, and personal orgs.
Note If you’re familiar with Tableau, these are similar to site roles.
### Tableau Unmetered Admin or Tableau Next Admin
Included license: Tableau Next Creator or Tableau Next Creator (Legacy)
Users with these permission sets can configure Tableau Next and manage users. In addition, they can manage workspaces and assets, including managing sharing for all assets.
- Access Tableau Next Studio
- Use Tableau Agent
- Configure Tableau Next and manage users
- Manage sharing for all assets, and manage Analytics Groups
- Manage all assets (workspaces, dashboards, visualizations)
- View and list assets in the Marketplace
- Own and manage Personal Orgs
- View, explore, and follow metrics
- Access Slack entry points to Tableau Next assets
### Tableau Unmetered Platform Analyst or Tableau Next Platform Analyst
Included license: Tableau Next Creator or Tableau Next Creator (Legacy)
Users with these permission sets can manage workspaces they own or that are shared with them.
- Access Tableau Next Studio
- Use Tableau Agent
- Manage and share owned assets (workspaces, dashboards, visualizations)
- View the Marketplace
- Own a Personal Org
- Share snapshots
- View, explore, and follow metrics
- Access Slack entry points to Tableau Next assets
### Tableau Unmetered Self-Service Analyst or Tableau Next Self-Service Analyst
Included license: Tableau Next Creator or Tableau Next Creator (Legacy)
Users with these permission sets can edit assets in their Personal Org and view assets in production.
- Access Tableau Next Studio
- Use Tableau Agent
- View assets (workspaces, dashboards, visualizations)
- Share snapshots
- Own a Personal Org
- View, explore, and follow metrics
- Access Slack entry points to Tableau Next assets
### Tableau Unmetered Self-Service Consumer or Tableau Next Self-Service Consumer
Included license: Tableau Next Creator or Tableau Next Creator (Legacy)
Users with these permission sets can browse, view, and interact with assets in production.
- Access the Tableau Next home page
- Browse metrics and dashboards
- Use Tableau Agent
- View assets (workspaces, dashboards, visualizations)
- Share snapshots
- View, explore, and follow metrics
- Access Slack entry points to Tableau Next assets
### Tableau Unmetered Consumer or Tableau Next Consumer
Included license: Tableau Next Consumer (Unmetered) or Tableau Next Consumer (Legacy)
Users with these permission sets can view assets in on the Tableau Next home page.
- Access the Tableau Next home page
- Use Tableau Agent
- View assets (workspaces, dashboards, visualizations)
- Share snapshots
- View, explore, and follow metrics
- Access Slack entry points to Tableau Next assets
### Tableau Next Limited Consumer
Included license: Tableau Next Limited Consumer
Users with this permission set can’t access Tableau Next Home or Studio. They can only view embedded assets in Tableau Next Apps for Salesforce.
- View assets in Tableau Next Apps for Salesforce (also known as Included Apps)
- Share snapshots
- Access Slack entry points to Tableau Next assets
- Access unmetered Analytical Insights
### Tableau Included App Manager
Included license: Tableau Next Included App
Users with this permission set can’t access Tableau Next Home or Studio. They can only manage pre-packaged (templated) Tableau Next Apps for Salesforce (Included Apps).
- Create, update, and manage app templates, and apps from templates, analytics, data, and other assets
- Access unmetered Analytical Insights
#### See Also
- [Assign a User a Tableau Next Permission Set](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_assign_tableau_permset_to_users.htm&release=264.0.0&type=5 "Assign permissions to users based on their level of interaction with Tableau Next capabilities. Users must already be created in Salesforce. You can’t add users in the Tableau Next app. Each Tableau Next permission set that you assign to a user consumes a license. You can view your license status as you assign permission sets.")
- [Tableau Next Permission Sets and Licenses](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_permsets_licenses.htm&release=264.0.0&type=5 "Each user that interacts with Tableau Next requires a license and a permission set. Each Tableau Next license maps to one or more standard permission sets that allow different levels of interaction with Tableau Next capabilities.")
## Data Visibility - Policies
Policies allow and deny access to Data 360 objects (like DLOs, DMOs, and CIs) and records and also mask fields within data spaces. They can be widely applied with minimal data preparation and are implemented differently than security in Tableau or CRM Analytics.
In Tableau, data security is generally managed with record-level security inherited from the data source, either through a manually-defined entitlement table or by pass-through authentication.
In CRM Analytics, data security is defined independently on each dataset, either through sharing inheritance or a security predicate driven by augments, calculated fields, and hierarchy flattening in data prep.
A Data 360 administrator can define policies in [Data Governance in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_data_gov_capabilities.htm&language=en_US).
## Data 360 Policies in Tableau Next
Data 360 controls data access centrally, through policies defined in Data Governance. In contrast, CRM Analytics defines data access at the dataset level and record-level security in Tableau is driven by the data source.
### Object-level and record-level policies
Record-level security (RLS) is more restrictive than object-level security (OLS). If any RLS is defined on an object, all access to that object will require explicitly defined RLS policies.
### Policy evaluation
Rather than the binary “true or false” predicate evaluation in CRM Analytics or an entitlement table in Tableau, Data 360 policies are evaluated in layers.
Deny
Policies that deny access to data are applied first. Restrict data access to records and fields with classifications, tags, and user attributes. Masking and allow policies can’t override a deny policy.
Note
**Users with View All Records or Modify All Records permission**
A user with one of these powerful permissions can see object and field metadata, even if a deny policy restricts their access to the data in that object or field. This allows them to interact with the objects and fields in semantic models, visualizations, metrics, and other places without seeing the contents.
Mask
Policies that mask fields are applied next. A masking policy obfuscates the value in a specific field. Masking policies can’t override a deny policy.
Allow
Policies that allow access are applied last. Grant data access to objects and records with classifications, tags, and user attributes, including hierarchies. Allow policies can’t override a deny or masking policy.
### Metadata policy criteria
Data 360 uses metadata in the form of Data Tags and Classifications as criteria for policies. This allows for flexible, scalable security such as “Deny access to all fields tagged as PII.” Data governance also supports logic using explicit field value comparisons, similar to CRM Analytics and Tableau security.
### Data structure considerations
Data 360 can evaluate policies against separate tables and data sources with joins built into policy criteria. CRM Analytics requires that data used for security predicate evaluation is present in the dataset. When designing your governance plan for Tableau Next, think of policy criteria (including metadata and user attributes, hierarchies, and entitlements) as the record-level filters applied to the data, rather than being part of the data that is being filtered. No need to determine grain, flatten multi-layer relationship tables, and build complex join and augment structures in data prep.
#### See Also
- [Data Governance in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_data_gov_capabilities.htm&language=en_US)
- [Dynamic Data Masking Policies in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_dynamic_data_masking_policies.htm&language=en_US)
- [Data Tagging and Classification in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_using_tagging_and_classification_dg.htm&language=en_US)
## Data Source Record-Level Security
Configure record-level security differently depending on the data source.
### Data 360 DMO or DLO
Define policies in Data 360 to control record-level access.
### Zero Copy DLO
Data source connections return records based on the access of the authentication user defined in the connection. The DLO doesn’t apply security based on the logged-in user by default. To control record-level access, define policies based on user attributes in Data 360.
If you’ve already configured an entitlement table for your external data source, don’t despair! You can define [record-level security with an entitlement table](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&release=264.0.0&type=5 "To control record-level security for zero-copy DLOs, connect an entitlement table that describes user-level record access and define an allow policy with it. Upload a CSV file and create a filtered join in the policy.").
### Tableau Published Data Source (PDS)
A PDS is a direct connection, it isn’t represented as a DLO in Data 360. Data access isn’t configured through data governance. For users configured in Tableau Cloud, record-level security is inherited from the PDS.
## Allow Policy Patterns in Tableau Next
Policy criteria can be layered and mixed to achieve your desired data visibility results. Here are some common policy structures.
Define an allow policy with the following selections in Data Governance.
- **Resource**: Record
- **Action**: Allow access
- **Apply To Object**: Select object...
Choose when the policy’s action (in this case, allowing access) should occur.
Criteria within a policy can be linked together in logical groups to build complex access patterns. Add a group to **Take Action On** Records which meet any condition (OR) for a set of criteria that each grants access, or Records which meet all conditions (AND) for a set of criteria that all must be true to grant access.
### Record ownership
Data 360 doesn’t have automatic record owner visibility. If a DLO or DMO has a field containing the record owner’s Salesforce User Id, this condition tests if the user is the record’s owner.
**Field Name** Object\_Name > Owner Id **Is Equal To** User > User Id
Note
This is equivalent to 'ObjectOwnerId' == "$User.Id" in a CRM Analytics security predicate.
This is similar to using the USERNAME() fuction to filter extracted rows in Tableau.
Record ownership must be included at the root DMO or DLO level. Filtering on user data joined to an object in the semantic layer shouldn’t be used in place of a security feature.
### Working with Salesforce hierarchies
Before role, manager, or territory hierarchies in Salesforce can be used in policies, they need to be connected to a Data 360 data source. Set up a [Salesforce CRM Connector](https://help.salesforce.com/s/articleView?id=data.c360_a_salesforce_crm_connector.htm&language=en_US) to the org where the target hierarchy resides then add a new hierarchy with the steps in [Ingest Hierarchical Data](https://help.salesforce.com/s/articleView?id=data.c360_a_ingest_hierarchy_data.htm&language=en_US).
### Role hierarchy
After ingesting the Salesforce role hierarchy, this condition tests if the user is hierarchically above the record’s owner.
**Field Name** Object\_Name > Owner **Is Hierarchally Above In** Role\_Hierarchy > User
Note
This is equivalent to 'ObjectOwner.Roles.Roles' == "$User.UserRoleId" in a CRM Analytics security predicate.
## RLS with Entitlement Tables
To control record-level security for zero-copy DLOs, connect an entitlement table that describes user-level record access and define an allow policy with it. Upload a CSV file and create a filtered join in the policy.
### Entitlement table structure
An entitlement table in Data Governance needs one row for each record-user association, using the 15-character record and user IDs. For example
| accountId | userId |
| --- | --- |
| 001aa000000AAA1 | 005aa000000Usr1 |
| 001aa000000AAA1 | 005aa000000Usr2 |
| 001aa000000AAA1 | 005aa000000Usr3 |
| 001aa000000BBB2 | 005aa000000Usr1 |
| 001aa000000BBB2 | 005aa000000Usr3 |
| 001aa000000CCC3 | 005aa000000Usr2 |
- Users 1 and 3 can see data associated with Accounts 1 and 2.
- User 2 can see data associated with Account 1 and 3.
### Upload a CSV to a data stream
Follow the steps in [Ingest Data by Uploading a File](https://help.salesforce.com/s/articleView?id=data.c360_a_upload_a_csv_file.htm&language=en_US) to create your entitlement table in Data 360.
### Use a join in a policy
Add a join block to the policy criteria and choose the DLO holding the entitlement table. Specify the Entitlement Table > Object Id as the first field and the Object > Object Id as the second field.
Add a filter to return records only if the user is associated with the record in the entitlement table.
Entitlement Table > User Id **Is Equal To** User > User Id
## Asset Access - Sharing
Sharing an asset within Tableau Next grants another user visibility and capabilities related to that asset. Sharing doesn’t override policy-based restrictions.
An asset owner can [Manage Access to Assets in Tableau Next](https://help.salesforce.com/s/articleView?id=analytics.tua_share_access.htm&release=264.0.0&type=5 "Manage access to workspaces, dashboards, visualizations, and semantic models in Tableau Next. Use the share option to add or remove viewers or editors for an asset. Access to data model objects and data lake objects is controlled in Data 360."). Users with the Tableau Unmetered Admin or Tableau Next Admin permission set can manage sharing for all Tableau Next assets.
| Action |
Viewer |
Editor |
Owner |
| View and interact |
|
|
|
| See who has access |
|
|
|
| Modify and save |
|
|
|
| Share |
|
|
|
| Delete |
|
|
|
