Long-form explainers on governing Tableau content, semantic layers, lineage and what an assistant should never be allowed to do. Written for somebody who has to make it work on Monday.
Each of these ends with a list of repository paths and product surfaces you can go and open.
Ownership, certification and the content nobody has opened in a year.
Four things get called governance: certification, ownership, stale content and change control. Here each one is written as a check you can run, not an aim you can state. It also covers the one change that passes a visual review and is still wrong.
An assertion is a sentence. Evidence is something a second person can check without asking you. What an audit trail has to contain, what a hash actually proves, and what to require of any tool that claims to produce one.
A certification is a flag and a sentence, set by somebody who was sure at the time. What that asserts, what it leaves to you, who should hold it, and the three ways it quietly stops being true.
A permission question is asked like a lookup and behaves like a calculation. The inputs, the order they resolve in, why the answer takes six screens to reach, and what a read-only layer can tell you about it without touching anything.
Catalogs, semantic layers, and following a number back to the column it came from.
A semantic layer gives a metric one home. Each tool that works out the metric reads that one home. They all get the same number. Here is what that means in practice, and what changes when you run more than one warehouse.
Table-level lineage tells you that a dashboard touches a table. Column-level lineage tells you which dashboards break when you drop a column. Here is the difference, why the last hop is hard, and how to read a map without drowning in it.
A metric contract is what a semantic layer looks like once something is actually enforcing it. How a definition gets pinned, what happens to a question naming fields from two warehouses, and why the identifiers reaching the SQL come from the contract itself.
The access a governance layer needs is narrow, specific and worth naming precisely. What gets read from a catalogue, what read only means when it is structural, not promised, why your own warehouse role stays the boundary, and what inheriting a catalogue buys you.
What an assistant should be allowed to do, and what has to reach a person first.
The approve to run rule, in plain words. The assistant reads, explains and proposes, and a person owns the write path. What that costs, what it buys, and three questions to ask of any AI feature.
The model drafts, a person approves, and the approval is what runs. How a proposal reaches the gate, what the gate asks for, and what an approval has to record to be worth showing anybody.
Your key, your provider account, your terms. What that changes about where a prompt travels and who holds the commercial deal. What an OpenAI-compatible endpoint opens up, and why the software arrives complete with the AI switched off.
Who asked, when, which model answered, what it cost, and what shape the answer had. The fields that turn an AI log into evidence, the two kinds of row worth keeping apart, and the case for leaving conversation content where it was written.
Credentials, access, and the work that lands on an administrator on a Tuesday.
A person leaves. Their name stays on workbooks, schedules and subscriptions, and several of those fail without a sound. What they hold, what breaks, and the order that keeps the license recoverable.
Two Tableau credentials doing two different jobs. One carries a person’s permissions. The other extends a platform capability. Picking the right one keeps a permission model you spent years building in charge of who sees what.
A token is easy to create and easy to forget, and the forgetting is where the outages come from. Who owns one, what its expiry does to a job nobody is watching, what happens when the owner leaves, and how to rotate one without a gap.
A chained record is worth what a second person can check on their own. What one row holds, what the chain proves by itself, and what it hands to other controls. Then how an auditor re-verifies an export with their own tools.
What has to move, what breaks on the way, and what to check before it does.
Content is the easy part of a migration. This is what has to move with it, what tends to break quietly afterwards, and what a governed migration checks before anyone approves a run.
Content mostly behaves. The attachments around it are separate objects with their own owners and their own schedules, and they are what fills a support queue on the Monday. Here is how to enumerate them while the source is still running.
If a word in one of these is doing more work than it should, the Glossary defines it in a sentence or two. If you arrived with a procurement question rather than a technical one, the Questions and Answers answers it directly, including the ones about what the product deliberately leaves alone.