Deployment, Sharing, and Governance of Content
Publishing and content structure
Content lives on Tableau Server or Tableau Cloud inside sites, organized into projects (which can nest). Two content types matter most: workbooks and published data sources - the latter is the governance lever that lets many workbooks share one certified definition. When publishing you choose live vs extract; a scheduled extract refresh requires stored credentials (embed a password, use an OAuth/service account, or let Server run as a saved user). Live connections likewise prompt or store credentials per data source.
Permissions and roles
Site roles (Creator, Explorer with/without publish, Viewer, Server/Site Administrator) cap what a user can do; project permissions grant capabilities like View, Filter, Connect, and Publish. The most restrictive rule wins, so a Viewer cannot be granted Publish no matter what the project says. Permissions are inherited from the parent project; locking a project prevents child items from having their own rules. Use groups rather than individuals, and check All Users defaults.
Security, governance, and distribution
Row-level security is usually implemented with a user filter ([User] = USERNAME() or IS_MEMBEROF), a data source filter, or database-side security. Certified data sources and data quality warnings guide users to trustworthy content; lineage/impact analysis shows what breaks if you change a field. Subscriptions email images or PDFs on a schedule and require View permission; data-driven alerts fire on a condition; metrics track a single number.
Traps to watch
- Site role vs project permission conflicts.
- Extract refresh failing because no credentials were saved.
- Assuming a subscriber can receive content they cannot view.
Rule of thumb
Publish the data source once with embedded credentials and grant Connect, then let workbooks connect to it - one place to fix logic, one place to secure rows.