Looker Business Analyst: Analysis, Sharing, and Governance

What the domain tests

Analysis, Sharing, and Governance tests how content moves from an analyst to an audience and how access is controlled. Expect roles and permissions, folders and inheritance, content validation, schedules and alerts, downloads, and usage monitoring. The theme is separation of duties: model access, content access, and database row access are different controls.

Core rules

• Roles grant capabilities: explore, save Looks, edit dashboards, manage schedules, or develop LookML. Folder access grants visibility to content. A user needs both the capability and a path to the folder.
• Folder permissions inherit unless overridden. Moving content can change who can see it. Personal folders are not a substitute for shared team folders.
• Content validation scans Looks and dashboards for broken references after LookML changes, such as a removed field or changed join. It reports errors; it does not repair content.
• Schedules deliver Looks or dashboards on a cadence; alerts evaluate a condition and notify when it is met. Both run with the permissions of the user who created them, so an owner's access change can break delivery.
• Downloads and exports are governed by permissions and can expose row-level data. access_filter with user attributes enforces row-level security consistently across Explores, schedules, and alerts.

Worked example

A regional sales VP needs a dashboard showing only her region. The developer adds an access_filter on region using the user attribute region. The admin creates a role that can view dashboards but not edit LookML, and grants the VP access to the Sales folder. The VP schedules a Monday delivery. When the schedule runs, Looker applies the access filter for the VP's user attribute, so the delivered dashboard contains only her region. If she is later moved to another region, the attribute changes and the same dashboard shows the new region without editing the LookML. The reasoning: row-level security belongs in the model, not in a manually filtered Look, and delivery still respects the recipient's data access.

Traps

Granting folder access without the role capability leaves content unusable. Granting a broad role to solve a folder problem overexposes content. Assuming a schedule sends the owner's full data to every recipient ignores access filters and schedule ownership. Content validation is not a performance test or a data-quality test. Deleting or renaming a field without checking usage breaks saved content; use validation and usage data before changing LookML.

Key points

• Roles grant actions; folders grant content visibility; both are required.
• Folder permissions inherit and change when content moves.
• Content validation finds broken references after model changes.
• Schedules and alerts run with the creator's permissions.
• Access filters enforce row-level security in the model, not in each Look.