By actual activity, because role names alone do not prove necessity. A powerful Tableau role may be assigned for convenience, inherited through group membership or left unused after a project ends. Certification should combine the assigned role, effective permissions and audit evidence so reviewers can keep only access that is still justified.
Certification should be based on what people actually do in Tableau, not on a role label by itself. Role names are a starting point, but they can overstate necessity when access was granted for convenience, inherited through a group, or left in place after the work changed. Effective review means checking whether the access is still needed for current duties and data use.
Why actual activity is the safer certification basis
Actual activity gives reviewers evidence of whether access is being exercised in a way that matches the job. In Tableau, that means comparing the assigned role with recent usage, published content, administrative actions, extract management, and any delegated responsibilities. A role can describe potential capability, but certification should test whether that capability is still justified in practice.
This matters because access reviews are meant to remove stale privilege, not simply confirm that an entry exists in a directory or group. A user may retain a broad Tableau role after a project ends, after a team re-org, or after temporary elevation has outlived its purpose. If reviewers rely only on the role name, they can miss privilege creep and dormant access.
For certification, the useful question is not “What role does this person have?” but “What evidence shows they still need this level of access?” The answer should combine role assignment, effective permissions, and observed activity so the reviewer can decide whether the access is necessary, excessive, or unused.
How to review Tableau access without over-trusting role labels
Start with the assigned role, then verify the effective permissions that come from direct grants, group membership, and any inherited capabilities. A role that looks moderate on paper can still produce broad access once nested groups, project ownership, site administration, or content permissions are added. That is why the effective access view is more reliable than the nominal role alone.
Then test the access against actual use. Recent authoring, publishing, subscription management, workbook ownership, data source access, and administrative activity all help show whether the access is active and necessary. If there is no meaningful activity, the reviewer should ask whether the access is only historical and whether a narrower role would still support the work.
Role-based certification still has value as a control checkpoint, but it should be treated as a summary, not as proof. In practice, the strongest review decisions come from matching role, permission set, and activity evidence together. That approach is especially important where a single Tableau role can cover several business functions with very different risk levels.
What a defensible certification decision should include
A solid access certification record should show three things: what role was assigned, what effective access that produced, and what activity or business need justified keeping it. If any one of those is missing, the review is weaker. If the role is broad but the activity is narrow, the reviewer should usually consider reduction rather than renewal.
When access is justified through a group rather than a direct assignment, reviewers should still validate the individual user’s need. Group membership often hides the real reason the access exists, which makes it easy to renew unnecessary privileges by habit. The reviewer should be able to trace the access back to a current business purpose, not just to a historical entitlement.
Where Tableau access supports administration or data access that could affect many users or sensitive dashboards, the justification threshold should be higher. In those cases, certification should confirm both continued business need and acceptable scope, because broad access is harder to notice when it becomes excessive.
Risk and Threat Considerations
Role-name-only certification can preserve unused or inherited access long after the business need has ended. That creates avoidable exposure because the entitlement may still allow data viewing, content changes, or administrative actions even when the user is no longer performing the original task.
Failure mechanism: reviewers treat the role label as evidence of necessity, so inherited group access, stale project permissions, or convenience-based elevation remain in place and continue to grant more privilege than the user actually needs.
Impact: excessive Tableau access can widen data exposure, increase the blast radius of mistakes, and make it harder to detect when access has quietly drifted beyond the current job function.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Tableau access certification is a periodic account and entitlement review. |
| AC-6 — Least Privilege | The question asks whether access should track actual need rather than broad role labels. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Actual activity is central to deciding whether Tableau access remains justified. | |
| Recommendation — Review assigned Tableau access periodically and remove accounts or entitlements no longer justified. Limit Tableau privileges to the minimum access required for current duties. Use audit evidence to validate whether Tableau access is still being used appropriately. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | The subject is a practical access review decision based on need and use. |
| Recommendation — Validate Tableau access against business need and remove unnecessary privilege. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Certification by actual activity is an access control governance decision. |
| Recommendation — Base Tableau access decisions on current need, not role title alone. | ||
Practitioner Guidance
What to verify: Confirm the effective permissions behind the Tableau role, not just the role name, and check whether group membership or inheritance is expanding access beyond what the user should hold.
Decision rule: If activity evidence does not show current use that matches the access level, treat the entitlement as a removal or downgrade candidate rather than renewing it by default.
What good looks like: Reviewers can explain, for each retained access path, why the user still needs it, what they actually do with it, and why a narrower role would be insufficient.
Practitioner takeaway: Access certification should validate necessity, not status. In Tableau, that means basing the decision on real usage and effective permissions, with role names used only as the starting point for review.
Related resources from NHI Mgmt Group
- What is the difference between role-based access and API key governance for NHI security?
- How do organisations keep role models aligned with actual access use?
- How should security teams run access reviews for non-human identities?
- How should security teams govern non-human identities that have persistent access?