Agent WranglersAccess and BI tools
Grant warehouse access by role from the directory, mask personal columns, give each tool its own narrow account, and stop data leaving by link.
- Required 3
- Recommended 2
Required
Mask personal columns for everyone outside a named role
DEN-29Tag every personal column in the warehouse. Mask or hide tagged columns from every role except the few named for them.
Give each pipeline and BI tool its own narrow account
DEN-30Give each loader, transformation job and BI tool a separate account that reaches only its own schemas. BI tools get read access to the marts and nothing else.
Filter shared dashboards by customer inside the warehouse
DEN-31When customers see dashboards built on shared tables, filter rows by customer in the warehouse or in a signed embed token. Never rely on a filter set in the dashboard alone.
Recommended
Grant warehouse access by role from the directory
DEN-28Give people access to the warehouse and BI tools through roles kept in code and synced from the company directory. Grant nothing to a single person on a single table.
Limit exports and public links from BI tools
DEN-32Turn off public dashboard links and scheduled reports to addresses outside the company's domains in every BI tool. Allow raw exports of personal columns only to the roles that may see them.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools">Agent Wranglers data engineering playbook</a>. In code you write, add a comment next to it with the same link.