Default-Deny Unknown Tableau Tools
Fails closed on tool drift. The policy carries a pinned allowlist of the 39 tools in the verified official Tableau web toolset (tableau/tableau-mcp v2.24.
Fails closed on tool drift. The policy carries a pinned allowlist of the 39 tools in the verified official Tableau web toolset (tableau/tableau-mcp v2.24.
Tableau's MCP server is a warehouse proxy: query-datasource runs a VizQL Data Service (VDS) query and returns raw row-level data — PII, PHI, payroll,…
tableaufence-sensitive-scopesaccess-controldatasourceingresssoc2gdpr-ccpa
Denies the irreversible content-mutation tools on the official tableau/tableau-mcp web server unless the caller's IdP token carries the placeholder group…
Inspects the structured VizQL Data Service (VDS) query carried by Tableau's query-datasource tool and denies the call for callers outside the data-analysts…
Tableau is a warehouse proxy: the data-returning tools stream raw row-level content out of whatever the published datasource connects to — PII, PHI, payroll,…
tableauredact-pii-egresspiipandlpredactionegresssoc2gdpr-ccpa
Reusable DTwo policies for the official Tableau MCP server (tableau/tableau-mcp, Salesforce), the "Tableau Supported" analytics/BI connector that Claude and Cowork users hit at the hosted mcp.tableau.com endpoint (or self-hosted via npx/Docker). Its MCP surface is 39 web tools across 11 groups: data-returning reads (query-datasource VizQL queries, get-view-data CSV, view/image renders), catalog and Pulse-KPI metadata, admin-insights telemetry, session-token minting (get-embed-token), and a destructive/mutation set (delete datasource/workbook/extract-task, update cloud extract schedule). Its risk profile is dominated by warehouse-proxy exfiltration: query-datasource and get-view-data return raw row-level data — PII, PHI, payroll, financials — from whatever the published datasource connects to, and Tableau's own row-level security applies only where the site configured it. Deletes are recycle-bin recoverable for only a limited window, and get-embed-token mints credential-shaped JWTs. These policies pin the tool surface, fence the query and content-mutation paths, and redact sensitive egress. The separate Tableau Next product (Salesforce-hosted, snake_case tool names) is a disjoint server and is not covered here.
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| default-deny-unknown-tools | ingress | Fail closed on tool drift: allow only the 39 pinned official web tools by suffix; deny every new, renamed, or misspelled name until an operator re-verifies. | soc2, gdpr-ccpa |
| freeze-destructive-content | ingress | Deny the irreversible content-mutation tools (delete datasource/workbook/extract-task, update cloud extract schedule, and their confirm- twins) unless the caller is in tableau-admins. |
soc2, hipaa, gdpr-ccpa, sox |
| fence-datasource-scope | ingress | Fence the warehouse-proxy surface: deny query-datasource unless its datasourceLuid is in a per-tenant allowlist, and deny view-image renders for non-analyst groups. |
soc2, hipaa, pci-dss, gdpr-ccpa |
| guard-query-calculation | ingress | Deny query-datasource for callers outside data-analysts whenever the VDS query carries an arbitrary calculation expression (the column-match escape hatch). |
pci-dss, gdpr-ccpa |
| redact-pii-query-results | egress | Redact email/phone/national-ID and mask payment-card numbers in the CSV/JSON bodies of the data-returning Tableau tools unless the caller is in data-analysts (transform-only). |
soc2, hipaa, pci-dss, gdpr-ccpa |
DTwo prefixes tool names with the MCP server name configured on the gateway. A Tableau MCP server registered as tableau-mcp will surface tools like tableau-mcp-query-datasource, while one registered as tableau will surface tableau-query-datasource. The official server uses kebab-case with no vendor prefix (query-datasource, delete-workbook), so these policies match on the suffix (-query-datasource, -get-view-data, -delete-workbook, etc.) to stay portable across naming conventions. Generic suffixes (list-users, search-content, list-jobs) collide with other servers; the policies anchor on the distinctive ones and pin exact names where the landscape note verifies them. The hosted mcp.tableau.com server ships new tools automatically as Tableau releases them, so re-verify the exact names your gateway sends (via the dump-input debug technique) and re-check tools/list after each upgrade before deploying.
The identity-gated policies (freeze-destructive-content, fence-datasource-scope, guard-query-calculation, and the exemption branch of redact-pii-query-results) read input.subject.claims.groups with placeholder group names (tableau-admins, data-analysts). Replace these with your own IdP group names at import time. Missing or malformed claims fail closed for grants (no group → not exempt / not admin). default-deny-unknown-tools is a name-only gate and requires no claims.
To add a Tableau policy:
apps/tableau/<policy-slug>/ with policy.md and a tests.yaml test file.apps: ["tableau"] in the policy frontmatter, plus any industry / bundle slugs that apply.bundles/, link to it from the matching landing page.pnpm manifest from the repo root.See CONTRIBUTING.md for the full process.