Authentication, Authorization, and Security
Authentication vs. authorization
Authentication establishes identity; authorization decides what that identity can do. Alteryx Server supports built-in authentication (local user accounts) and integrated authentication via Windows/Active Directory (often through SAML or Windows auth). Know that SAML/SSO maps external identities to Gallery users, and that user roles (Curator, Artisan, Viewer) are assigned during provisioning.
Roles and permissions
Understand the built-in roles: Curator (admin-level, manages users, collections, and server settings), Artisan (can create, schedule, and share workflows), and Viewer (can run and view shared content but not create). Permissions are layered: a user's role sets a ceiling, and per-asset or per-collection permissions refine access. The trap is assuming a high role overrides a missing asset permission - it does not; asset-level sharing still gates visibility.
Security controls
Know that SSL/TLS should be enabled for the Gallery, that API access uses keys with scoped permissions, and that secrets (credentials) are stored encrypted and managed separately from workflows. Data connection credentials live in the credential store, not in the workflow file.
Traps
Questions conflate authentication with authorization, or assume Curator is required to run a workflow (Viewers can run shared workflows). Another trap: assuming SAML users are auto-provisioned with full rights - they get the role assigned by the provisioning rule. Also watch for answers that store passwords inside workflows.
Rule of thumb
Role sets the ceiling; asset/collection sharing sets the floor. A user sees content only where both allow it.