--- schema_version: "1" id: bc3cfcae1321c381904067c5dd7ecd2f9de0f61bf7591d23eaa5dfa38f9910fc title: Permission Capabilities and Templates collection: tableau version: next locale: en-gb portal_url: https://docs.salesforce.com/tableau/next/en-gb/server-linux/permissions_capabilities.md canonical_url: https://help.tableau.com/v0.0/server-linux/en-gb/permissions_capabilities.htm source_site: help.tableau.com content_type: documentation content_hash: 62ba963a1f35d161be354cee3b431bbd2fb261f23a48de9c0672a476f02a6812 description: Understand permission capabilities and templates for assigning content access. --- [Skip to main content](#main-content) # Permission Capabilities and Templates Permissions are made up of capabilities, or the ability to perform a given action on a piece of content, such as view, filter, download or delete. Each row in the Permission Rules area of the dialog is a _permission rule_. Permission rules are the setting for each capability (allowed, denied or unspecified) for the group or user in that row. Permission rules have _templates_ available that make it easier to assign capabilities quickly. Permission rules can also be copied and pasted. **Note**: In the permission dialog for projects, there are tabs for each content type: Projects, Workbooks, Data Sources, etc. When a permission rule is added, the default for all capabilities across all content types is Unspecified. To allow or deny capabilities for each content type, you must go to each tab of the permission dialog in turn. This sets the pattern for all content of that type in the project (such as all workbooks). In the permission dialog for a specific piece of content, there are no tabs and the permission rules only apply to that piece of content. ## Templates Templates group sets of capabilities that are often assigned together based on common user scenarios, View, Explore, Publish and Administer. When you assign a template, its included capabilities are set to Allowed, with the rest left as Unspecified. The templates are cumulative, so the Explore template includes everything from the View template plus additional capabilities. All content also has a template for **None** (which sets all capabilities to unspecified) and **Denied** (which sets all capabilities to denied). Templates are meant to be a starting point and can be adjusted after they are applied. Capabilities can also be granted or denied without using a template at all. In both cases, the template column then shows Custom. ## Copy and paste permissions If there is a permission rule that needs to be assigned to multiple groups or users, you can copy and paste from one rule to another. You can’t copy from or paste onto a rule that involves Project Leader status. 1. Open the action menu (...) for the existing rule you want to copy from and select Copy Permissions. This is available only when the rule is not in edit mode. 2. Select an existing rule you want to paste over. You can also create a new rule by clicking + Add Group/User Rule and selecting a group or user. 3. Open the action menu (...) and select Paste Permissions. ## Effective permissions Remember, just because a user has been granted a capability in a given rule doesn’t mean they’ll have the ability to perform that action. There are site role caps on what a user can do (see [Permissions, Site Roles and Licences](https://help.tableau.com/v0.0/server-linux/en-gb/permission_license_siterole.htm)) and multiple permissions rules may need to be compared to evaluate the final capabilities for a given user (see [Effective permissions](https://help.tableau.com/v0.0/server-linux/en-gb/permission_effective.htm)). ## Capabilities Each content type has specific capabilities: ### Projects Projects have only two capabilities and two templates. For more information about project leaders and how to assign them, see [Project administration](https://help.tableau.com/v0.0/server-linux/en-gb/permissions_projects.htm#projectpermissions). #### View template ![View icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_view_icon.png)**View** lets a user see the project. If a user hasn’t been granted the view capability, the project won’t be visible to them. Granting the view capability for a project does not mean a user can see any content in the project, just the existence of the project itself. #### Publish template ![Save icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_save_icon.png)**Publish** lets a user publish content to the project from Tableau Desktop or Tableau Prep Builder. The publish capability is also required to move content into the project or save content to the project from web authoring. ### Workbooks #### View template ![View icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_view_icon.png)**View** lets a user see the workbook or view. If a user hasn’t been granted the view capability, the workbook won’t be visible to them. ![Filter icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_filter_icon.png)**Filter** lets a user interact with filters in the view, including keep-only and exclude filters. Users lacking this capability won’t see filter controls in the view. ![View comments icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_viewcomments_icon.png)**View Comments** lets a user view the comments associated with the views in a workbook. ![Add comments icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_addcomments_icon.png)**Add Comments** lets a user add comments to views in a workbook. ![Download full data icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_downloadimage_icon.png)**Download Image/PDF** lets a user download each view as a PNG, PDF or PowerPoint. ![Download sum data icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_downloadsumdata_icon.png)**Download Summary Data** lets a user view the aggregated data in a view, or in the marks they’ve selected, and download that data (as a CSV). #### Explore template ![Share Customised icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_sharecustomized_icon.png)**Share Customised** lets users add their custom views to the list of “Other Views” visible on a workbook. - When this capability is denied, users won’t see the “Make visible to others” option when they create a custom view. For more information, see [Use Custom Views](https://help.tableau.com/current/pro/desktop/en-gb/customview.htm). This capability doesn’t impact the ability to share a custom view with the share dialog or by copying the link. ![Download full data icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_downloadfulldata_icon.png)**Download Full Data** lets a user view the underlying data in a view, or in the marks they’ve selected, and download that data (as a CSV). - Download Full Data is not the same thing as Full Data Query, which is used by APIs on behalf of the user. ![Web edit icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_webedit_icon.png)**Web Edit** lets a user edit the view in a browser-based authoring environment. - Creating new content in the browser or saving views from the web edit interface requires a specific combination of capabilities. For more information, see [Web Editing and Web Authoring](https://help.tableau.com/v0.0/server-linux/en-gb/permissions.htm#webauthor). - The Web Editing feature must also be enabled for the entire site or even users with this capability allowed won’t be able to web edit. For more information, see [Set a Site's Web Authoring Access](https://help.tableau.com/current/server/en-gb/web_author_enable.htm). ![](/tableau/next/en-gb/server-linux/en-gb/Img/perms_explain_data_icon.png)**Run Explain Data** lets a user run Explain Data on marks in editing and viewing mode. - For Explain Data to be displayed as an option when a user selects a mark in a workbook, the feature must also be enabled as a site setting. To make Explain Data available in viewing mode, the feature must also be allowed by the author from within a workbook in Explain Data settings. For more information, see [Control Access to Explain Data](https://help.tableau.com/current/pro/desktop/en-gb/explain_data_control_access.htm). ![Full Data Query](/tableau/next/en-gb/server-linux/en-gb/Img/perms_full_data_query.png) **Full Data Query** lets an API or agent access the underlying data in a workbook data source. - Full Data Query (FDQ) is not the same as Download Full Data. FDQ is a pass-through permission capability that works in conjunction with API Access or AI Access to allow an API or an agent to query the workbook’s data on behalf of the user. - FDQ guarantees user filters are enforced only when they are data source filters, not filters at the workbook or sheet level. Row-level security with user filters must be set as data source filters. - VizQL Data Service interaction with the workbook’s data requires both FDQ and API Access permission capabilities. - If FDQ isn’t allowed, Tableau Agent in Dashboards has access to summary data only and therefore limited ability to discover deeper insights and analysis. FDQ is necessary for full functionality of Tableau Agent. #### Publish template ![Download workbook and save as icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_downloadwkbksaveas_icon.png)**Download Workbook/Save a Copy** lets a user download a packaged workbook (as a TWBX). Lets a user save (publish) a copy from the web edit interface as a new workbook. ![Save icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_save_icon.png)**Overwrite** lets a user overwrite (save) the content or asset on the server. - When allowed, the user can re-publish a workbook, data source or flow, or save a workbook or flow in web authoring, thereby becoming the owner and gaining access to all permissions. After this change in ownership, the original owner’s access to the workbook is determined by their permissions just like any other user. ![API access icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_api_access_icon.png)**API Access** lets a user query the workbook’s data source with the VizQL Data Service. For more information, see [VizQL Data Service](https://help.tableau.com/current/api/vizql-data-service/en-gb/index.html). ![](/tableau/next/en-gb/server-linux/en-gb/Img/perms_ai_access.png)**AI Access** lets a user use Tableau Agent in Dashboards, including Dashboard Overview, Dashboard Insights and Dashboard Q&A. - Also grant Full Data Query so the AI tool can access more than the summary data in the vizzes. ![](/tableau/next/en-gb/server-linux/en-gb/Img/perms_metrics_icon.png)**Create/Refresh Metrics** let a user create metrics on the views in a workbook and let any metrics that a user creates from those views refresh. The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-gb/metrics_create.htm). #### Administer template ![Move icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_move_icon.png)**Move** lets a user move workbooks between projects. For more information, see [Move content](https://help.tableau.com/v0.0/server-linux/en-gb/permissions.htm#MoveContent). ![Delete icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_delete_icon.png)**Delete** lets a user delete the workbook. ![Set Permissions icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_setperms_icon.png)**Set Permissions** lets a user create permission rules for the workbook. ![icon for extract refresh permission capability](/tableau/next/en-gb/server-linux/en-gb/Img/perms_extract_refresh.jpg)**Refresh Extracts** lets a user trigger an extract refresh for that workbook. ### Views In a workbook that is not in a locked project and does not show sheets as tabs for navigation, views (sheets, dashboards, stories) inherit the workbook permissions at publication, but any changes to permission rules must be made on individual views. View capabilities are the same as those for workbooks, except for **Overwrite**, **Download Workbook/Save a Copy** and **Move** which are only available at the workbook level. We recommend showing navigational sheet tabs whenever possible so views continue to inherit their permissions from the workbook. ### Data Sources #### View template ![View icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_view_icon.png)**View** lets a user see the data source on the server. ![Connect icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_connect_icon.png)**Connect** lets a user connect to a data source in Tableau Desktop, Tableau Prep Builder, Ask Data or web editing. - If a workbook author embeds their credentials to a published data source in a published workbook, they are essentially embedding their **Connect** capability. Therefore, users can see the data in the workbook regardless of their own **Connect** capability for that data source. If the workbook author doesn’t embed their credentials to the published data source, the user needs their own **Connect** capability to the data source to consume the workbook. For more information, see [Data access for published Tableau data sources](https://help.tableau.com/v0.0/server-linux/en-gb/permissions.htm#PublishedData). - A user must have the **Connect** capability for a data source to use Ask Data and to create Ask Data lenses. For more information, see [Enable Ask Data for Sites and Data Sources](https://help.tableau.com/current/pro/desktop/en-gb/ask_data_enable.htm#ensure-that-users-can-access-a-data-source). #### Explore template ![Download data source icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_downloaddatasource_icon.png)**Download Data Source** lets a user download the data source from the server (as a TDSX). - Cube data sources, like those for Microsoft Analysis Services or Oracle Essbase connections, must be used locally. To download the published data source to Tableau Desktop, the user must have the Download capability. For more information, see [Cube Data Sources](https://help.tableau.com/v0.0/server-linux/en-gb/datasource_cube.htm). #### Publish template ![Save icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_save_icon.png)**Overwrite** lets a user publish a data source to the server and overwrite the data source on the server. ![](/tableau/next/en-gb/server-linux/en-gb/Img/perms_api_access_icon.png)**API Access** lets a user query the data source with the VizQL Data Service. For more information, see [VizQL Data Service](https://help.tableau.com/current/api/vizql-data-service/en-gb/index.html). ![Create metric definitions icon](/tableau/next/en-gb/server-linux/en-gb/Img/perms_pulse_metric_icon.png) **Create Metric Definitions** lets a user connect to a data source to create Tableau Pulse metric definitions. For more information, see [Create Metrics with Tableau Pulse](https://help.tableau.com/current/online/en-gb/pulse_create_metrics.htm). #### Administer template ![Delete icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_delete_icon.png)**Delete** lets a user delete the data source. ![Set Permissions icon.](/tableau/next/en-gb/server-linux/en-gb/Img/perms_setperms_icon.png)**Set Permissions** lets a user create and edit permission rules for the data source. ![icon for extract refresh permission capability](/tableau/next/en-gb/server-linux/en-gb/Img/perms_extract_refresh.jpg)**Refresh Extracts** lets a user trigger an extract refresh for the data source. ### Other types of assets
 View templateExplore templatePublish templateAdminister template
FlowsView icon.View lets a user view the flow.Download data source icon.Download flow lets a user download the flow (as a TFLX).

Connect icon.Run lets a user run the flow.

Save icon.Overwrite lets a user publish a flow and overwrite the published flow.

Move icon.Move lets a user move assets between projects. For more information, see Move content.

Delete icon.Delete lets a user delete the asset.

Set Permissions icon.Set Permissions lets a user create permission rules for the asset.

 

Data RolesView icon.View lets a user view data roles.n/aSave icon.Overwrite lets a user publish data roles, overwrite published data roles and edit published data roles' synonyms.
Metrics (retired)View icon.View lets a user view metrics.n/aSave icon.Overwrite lets a user overwrite a metric and edit a metric's details.
Ask Data LensesView icon.View lets a user see the lens.n/aSave icon.Overwrite lets a user edit the lens.
Virtual ConnectionsView icon.View lets a user see the virtual connection.

Connect icon.Connect* lets a user connect to data using a virtual connection.

n/aSave icon.Overwrite lets a user edit the virtual connection.
DatabasesView icon.View lets a user see the database.n/aSave icon.Overwrite lets a user edit the metadata for the database.
TablesView icon.View lets a user see the table.n/aSave icon.Overwrite lets a user edit the metadata for the table.
CollectionsView icon.View lets a user view collections.n/an/an/a
\*By default, virtual connections have a Custom template that sets the View capability to Allowed but not the Connect capability. Be sure to set the Connect capability to Allowed so that users can connect using the virtual connection.