---
title: "Access and BI tools · Agent Wranglers"
url: https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools
parts: 5
tokens_total: 3393
updated: 2026-10-22
tokens: 716
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Access and BI tools

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Data engineering](https://agentwranglers.se/playbook/data-engineering.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

> Grant warehouse access by role from the directory, mask personal columns, give each tool its own narrow account, and stop data leaving by link.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools">Agent Wranglers data engineering playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- DEN-29 [Mask personal columns for everyone outside a named role](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/column-masking.md) · 614 tokens · updated 2026-10-22
  Tag every personal column in the warehouse. Mask or hide tagged columns from every role except the few named for them.
- DEN-30 [Give each pipeline and BI tool its own narrow account](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/tool-service-accounts.md) · 701 tokens · updated 2026-10-22
  Give each loader, transformation job and BI tool a separate account that reaches only its own schemas. BI tools get read access to the marts and nothing else.
- DEN-31 [Filter shared dashboards by customer inside the warehouse](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/dashboard-row-security.md) · 865 tokens · updated 2026-10-22
  When customers see dashboards built on shared tables, filter rows by customer in the warehouse or in a signed embed token. Never rely on a filter set in the dashboard alone.

## Recommended

- DEN-28 [Grant warehouse access by role from the directory](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/warehouse-roles.md) · 713 tokens · updated 2026-10-22
  Give people access to the warehouse and BI tools through roles kept in code and synced from the company directory. Grant nothing to a single person on a single table.
- DEN-32 [Limit exports and public links from BI tools](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/bi-sharing-limits.md) · 500 tokens · updated 2026-10-22
  Turn off public dashboard links and scheduled reports to addresses outside the company's domains in every BI tool. Allow raw exports of personal columns only to the roles that may see them.

- Previous: [Personal data in the warehouse](https://agentwranglers.se/playbook/data-engineering/personal-data-in-the-warehouse.md)
- [All chapters](https://agentwranglers.se/playbook/data-engineering.md)