TADX security

Site write access and managed policies

Publishing a workbook, editing a description, or deleting an asset changes something in Tableau Server or Tableau Cloud. TADX calls these changes mutations, or remote writes.

Site write access

This on/off setting controls whether TADX can change resources on a particular Tableau site. New sites start with writes off. This setting does not block reads.

You can change it with a CLI command. Agents are instructed to ask your permission first, but there is no enforced approval prompt. An agent can run the setting command itself if managed policy allows it.

Check without changing anything

tadx mutation status

Shows saved write access across your configured environments and any managed-policy restriction.

Managed policies

You customize these optional, machine-wide rules in a JSON file. A policy can block remote changes or disable individual operations, including reads. Templates provide initial settings.

Changing a properly protected policy file requires operating-system administrator authority. Unlike agent guidance, its restrictions are enforced by TADX. Keep agents unelevated and review the security limits.

Check without changing anything

tadx policy status

Shows whether a policy is active and its overall restrictions. Add --full for allowed capabilities and protection checks.

Checks before a remote change
Check order	Requirement
1. Managed policy	The policy permits the command and remote changes. No installed policy means no additional restriction.
2. Site write access	Writes are enabled for the selected Tableau server and site.
3. Tableau permissions	Tableau authorizes the authenticated user to make the requested change.

Any failed check blocks the change. Enabling site writes does not override a policy. A permissive policy does not enable site writes.

This table summarizes authorization checks. Command validation, target lookup, and required reads still apply.

Previews and forced operationsPreview a change without authorizing it.

Supported commands expose --preview to inspect proposed changes without applying them. A preview can still require live reads and permission to resolve its targets. Custom policy can deny those reads.

Neither --preview nor --force enables site consent or bypasses managed policy. A valid preview does not authorize a later mutation.

Agent authorizationAgent instructions do not replace CLI enforcement.

Agent Guidance tells agents to ask before changing saved site consent. Managed policy is an additional check enforced by TADX, not merely an instruction to the model. A blocked mutation does not become permitted because the agent retries or uses cached content.

An agent can request an administrator-authorized policy change. The installer uses Windows elevation or sudo on macOS and Linux. Approving that request can change the policy. Existing elevated privileges or cached sudo authorization can avoid a new prompt. Keep agents unelevated and review approval prompts.

Customize a policy

Policies are designed for you to customize. Start with a template, then edit the policy file to permit the operations you need. Templates are starting points, not fixed access levels.

You can add or remove permitted operations, including reads, and control whether remote changes are allowed. An administrator deploys your edited policy. Site write access and Tableau permissions still apply.

Template defaults

The unmodified templates below include all reads, including user, group, and permission information. Your customized policy can restrict those reads too.

read-only

Read Tableau information and work with local artifacts. Do not change remote Tableau resources.

Tableau mutationsBlocked

read-write-no-admin

Allow non-administrative changes. Block administrative mutations such as changing users, groups, or permissions.

Tableau mutationsNon-administrative only

superuser

Allow all currently supported operations, including administrative changes. Tableau permissions still apply.

Tableau mutationsAllowed by policy

All remote mutations still require saved site consent. The read-only template permits local writes, including cache refreshes and artifact downloads.

Reinstalling a template overwrites your custom policy at the selected location. To keep your changes, update the policy file instead.

The installer defaults to superuser. To block Tableau mutations, specify --template read-only. Installing the TADX CLI does not install a managed policy.

Edit and validate a policyCustomize permitted operations before deploying the file.

Edit a copy of managed-policy.json. The allowed_capabilities list contains the IDs of permitted TADX operations. Add or remove IDs to match your requirements. Set remote_mutations to false to block remote changes. Commands can also require permission for dependent operations.

Before deployment, check the edited file with tadx policy validate <file>. Validation does not activate the file or check its filesystem protection. Deploy the file with administrator authority, preserve its protection, and run tadx policy status --full. Avoid replacing the policy while commands are running. TADX reads it again for each new command.

Updating the CLI does not rewrite an installed policy. New capability IDs remain denied until an administrator adds them.

TADX accepts the older admin template name as an alias for superuser. It is not a fourth access level.

Policy format and customization guide ↗

Credentials

TADX authenticates to Tableau using personal access tokens (PATs). Interactive login validates the PAT before saving it in the native OS credential store.

StorageOS credential store

TADX stores the PAT name and secret with a fingerprint of the Tableau server and site.

ConfigurationSaved credential reference

Your configuration points to the saved record. It does not contain the PAT value.

AuthenticationIn-memory session

TADX retrieves the PAT when needed and uses the Tableau session token in memory for the command.

Credential storage by operating systemWindows Credential Manager, macOS Keychain, or Linux Secret Service.

Windows: A generic credential in Windows Credential Manager.
macOS: A generic-password item in Keychain, accessed through the native security tool.
Linux: Secret Service over D-Bus. A reachable service and an accessible, unlockable collection are required.

The stored record is checked against the configured server and exact site before use. Native-store failures are reported; TADX does not fall back to saving the PAT as plaintext in its configuration.

Save or remove credentialsLogin saves a PAT; logout removes its local record.

An agent must have your explicit approval before persisting a PAT. tadx auth login is the persistence action: it prompts for the PAT, validates it, and saves it. It does not show a separate TADX confirmation dialog after validation.

tadx auth logout removes the local saved credential; it does not revoke the token in Tableau. Revoke a compromised or no-longer-needed PAT in Tableau itself.

Automation and session dataSupply credentials through environment variables, not command arguments.

An environment profile can name environment variables for the PAT name and secret. A complete configured pair takes precedence over the stored credential. Protect the process environment and avoid placing secrets directly in shell commands or shared files.

TADX holds Tableau session tokens in command-local memory. Persistent coordination records use hashes and version counters, not raw PAT or session-token values. Job receipts can retain a credential-derived coordination hash, but that hash cannot authenticate to Tableau. TADX redacts credential-bearing output and diagnostics.

These controls do not protect against a compromised host, same-user malware, terminal recording, or another tool exposing a secret. Credential storage and session model.

Install a managed policy

The same command installs a policy on Windows, macOS, and Linux. Windows uses an administrator approval prompt; macOS and Linux use sudo in your terminal. Only the installer process gains privileges.

Version note: this page describes the current development source. Older releases might differ. Check tadx policy install -h and the release notes for your installed version.

tadx policy install --template read-only
tadx policy status --full

Review the elevation request. Installation replaces the policy at the selected destination; it does not change saved Tableau site consent. TADX does not collect or store administrator passwords.

Choose a policy directoryUse the platform default or a dedicated local directory.

Windows: The native Program Files directory, followed by TADX\managed-policy.json.
macOS: /Library/Application Support/TADX/managed-policy.json
Linux: /etc/tadx/managed-policy.json

Use --output to choose the containing directory, not a JSON filename. The parent must exist and the directory must be dedicated to the policy. On Unix, the full path must satisfy root-ownership, permissions, and link checks.

tadx policy install --template read-only --output "C:\TADX-policy"

Windows records the directory in the protected native 64-bit registry key HKLM\SOFTWARE\TADX\ManagedPolicy. Linux uses /etc/tadx-policy-location.json; macOS uses /private/etc/tadx-policy-location.json. These protected locators contain no credentials. User configuration cannot override them.

Reinstall or change directoriesInstallation replaces the selected file and preserves previous locations.

Reinstalling writes a new policy from the selected template and replaces any existing managed-policy.json in that directory. Omitting --output always selects the platform default, even after a custom installation. Include your custom folder again when you want to keep it active.

Switching directories updates the active location without deleting the old policy. Review the destination and template before approving elevation. Omitting --template selects superuser, not the previously installed template.

Windows file and directory protectionRequired permissions and warnings about parent directories.

TADX requires protected ownership and permissions on the policy file, its immediate installation directory, and the registry locator. Path integrity, reparse-point, and file-link checks remain mandatory.

Permissions on folders above the policy, including the drive root, are also checked. Unsafe or unverifiable ancestor protection produces a warning, not a refusal to use the policy. These warnings appear in policy installation receipts and tadx policy status, not on ordinary commands. TADX does not automatically change those permissions.

A protected file does not guarantee a protected path. Someone allowed to replace a folder above it could substitute another valid administrator-owned policy, including an older, more permissive one, between commands. Status distinguishes protected from path_protected; the loaded policy remains enforced when there is only an ancestor warning.

Use a fully protected path when you need protection against this substitution. An already elevated process can change protected policy, and Windows elevation settings determine whether approval or credentials are requested.

Recover from a failed installationInspect confirmed changes before retrying.

Canceling elevation before the installer process starts leaves the policy unchanged. After it starts, installation can fail after writing the file or replacing an active policy. TADX reports confirmed changes and the failure phase; it does not promise automatic rollback.

An invalid locator or a missing policy at its selected location blocks normal operations. Policy install, status, samples, validation, and help remain available for recovery.

Policy recovery and removal instructions ↗

macOS and Linux installationTerminal elevation and root-owned policy paths.

Run tadx policy install in a terminal. The system sudo command handles authorization; TADX does not receive your password. Sudo can reuse cached authorization, and an already-root process needs no elevation.

If no terminal is available, use an administrator terminal or run the CLI through sudo. Installation requires root ownership and protected write permissions throughout the destination path, with platform-specific ACL and link checks. Unlike Windows ancestor warnings, an unsafe Unix ancestor blocks installation. TADX does not change ancestor permissions.

Administrators can still deploy customized policies manually. Read the platform deployment and recovery instructions.

Local data and network access

Workbooks, inventory, and recovery records can contain business information. Protect the machine, workspace locations, and backups even when remote writes are disabled.

Files stored locallyConfiguration, content, caches, results, and recovery records.

TADX can store these files on your machine:

Configuration: server and site settings, saved mutation consent, workspace locations, and credential references.
Workspaces: downloaded or authored Tableau artifacts and local metadata.
Inventory caches: SQLite records with names, IDs, relationships, and other cached metadata.
Results and recovery: the last result, job receipts, and operation records, which can include target paths and result payloads.

TADX does not guarantee encryption at rest or secure deletion for these files. You control operating-system access, disk protection, backups, and retention. File locations and retention details.

Network protectionHTTPS for Tableau authentication and authorized requests.

PAT sign-in requires HTTPS, as do requests carrying Tableau session authorization. The default CLI uses Go's standard certificate verification and environment proxy behavior. The shared transport rejects cross-origin redirects and HTTPS downgrades.

Enterprise proxies, the system's trusted certificate authorities, and the local environment remain part of the trust model. TADX does not make a compromised or incorrectly trusted host secure.

Security limitations

TADX is not a sandbox. Its controls apply to TADX operations, not other tools an agent can run. They cannot protect a compromised operating system.

Administrator access

Keep agents unelevated. A process with administrator or root authority can change protected policy and its permissions. If an agent requests elevation, review the operation before approving it.

Checksums and provenanceInstallers verify checksums but do not verify signed provenance.

The installers download release archives over HTTPS and verify SHA-256 against that release's checksums.txt. This checks consistency with the fetched manifest.

The public-repository release workflow is also configured to generate signed GitHub build-provenance attestations for archives and standalone release files. The installers do not verify those attestations.

Checksum matching is not provenance verification. Even verified provenance does not establish that the source code or build workflow is secure. You can inspect the installer scripts and release workflow in the repository before use.

Agent Guidance and other toolsTADX restrictions do not apply to other clients or direct API access.

The installer and updater deploy TADX-owned Guidance for supported agent locations. That guidance does not configure Tableau authentication, enable mutation consent, or install a managed policy. It also does not prove that an agent host has loaded or followed the guidance.

Updates replace TADX-owned Guidance. Keep personal extensions separate. Tableau MCP is a separate connection and tool surface; a TADX policy does not govern MCP or direct Tableau API access through other tools.

Detailed security guide ↗Managed-policy manual ↗Release notes ↗