Tableau and Power BI read the lakehouse — with no second permission model

One feed, two connections

Tableau's own extension routes for web data have run out: Web Data Connector 2.x was removed in Tableau 2023.1, and WDC 3.0 is deprecated. Tableau's own recommended successor is the REST API Connector from the Tableau Exchange — a connector Tableau builds and signs, which reads an HTTP GET endpoint returning JSON or CSV.

So our side of this connection is not a plugin that would need maintaining and signing, but exactly the endpoint Tableau's official connector expects. Side effect: the same feed is readable from other tools with no extra work.

The same chain, no parallel route

This is where the connection differs from an ordinary one. It does not reimplement the permission model, it uses it.

Bearer verification                    -> user
token exchange (RFC 8693, aud=trino)   -> that identity
Trino: grants + row access + masking   -> that slice
WORM audit chain (thread_id "tableau") -> traceable

• No service account — the schema lookup runs under the analyst's exchanged token too
• Someone who may not see a table in Trino gets a 404 here
• Someone who may see it sees exactly the rows and columns their policies allow
• No caller SQL: the URL carries only catalog, schema, table, paging parameters and sort columns
• Read-only — what is generated is structurally a SELECT with ORDER BY, OFFSET and LIMIT

A BI route with its own permission model is a second truth about who may see what. This one has none.

Traceable down to the single page

Every data fetch writes an entry into the audit chain — one per page, value-free: target object, paging parameters, format. An extract in Tableau is therefore fully reconstructable, including the attempts Trino rejected. Responses go out as “no-store”, so governed data is not left sitting in any cache along the way.

Metrics instead of joins

The feed knows not only tables and views but the curated metrics of the semantic layer. A semantic view — a metric with stored joins — therefore reaches Tableau as one flat table, without the analyst needing to know the joins.

?catalog=…&schema=…&table=…     a table or view
?metric=<name>[&dimension=…]    a curated metric

No OLAP cube — and why that is not a loss

Looking for an OLAP connection in Tableau means looking for a multidimensional source: a cube queried through MDX. There is none here. The connection is relational, over the read-only feed. That is a deliberate choice, and Tableau's own documentation supplies the reasoning: cube sources run on Windows only, extracts cannot be created from most of them, data source filters are unavailable entirely, hierarchies must be defined in the cube beforehand, in a blend the cube may only be the primary source — and workbooks using a cube source cannot be published to Tableau Cloud.

And then the point that matters more here: a cube is a second copy with a second authorization model. With the feed, the platform's permission check applies, row and column policies come along, and every fetch writes an audit entry. What a cube can do that the feed cannot is pre-computed aggregates. If you need those, you define them as a metric rather than rebuilding them overnight.

Off as shipped

A BI connection is a data export path. A platform administrator should decide on it deliberately, not inherit a default. The switch therefore lives in the console, is stored in the database rather than an environment variable, is recorded in the WORM chain, takes effect without a restart — and is off as shipped. Off means the schema and data endpoints answer 403, regardless of the caller's rights.

• A per-page row cap that can only lower the hard limit in code — a larger value is rejected, not silently clamped
• A catalog allowlist as a second barrier in front of Trino: it answers which data may leave the building toward BI at all
• The allowlist does not replace permissions — someone who may not see a catalog in Trino still cannot, even if the list names it

BI meaning and business intelligence definition

BI stands for business intelligence: preparing and analyzing data to support business decisions. It includes traceable metrics, reports and dashboards. Reliable results require aligned definitions, periods and sources — for example, whether revenue includes or excludes cancelled orders.

BI dashboards on a shared data foundation

A BI dashboard brings together metrics for a task such as sales or procurement. Before designing it, define its audience and the decisions it should support. lavalake provides its own dashboards and the feed described here for external BI tools. The integration testing status stated above still applies to Tableau and Power BI.