A user needs one report, but must not see anything else in the workspace. What do you grant?
Why B is the answer
Item-level permission on that report
Item permissions grant access to a single item without a workspace role.
In detail
- Item-level permission gives access to one item only.
- A workspace role would expose every item in the workspace.
Use case
An illustrative scenario, not a real incident.
An external auditor needs one report and nothing else. Item permission gives exactly that, with no workspace role.
See it in different ways
flowchart TD A["Workspace roles"] --> B["Item permissions"] B --> C["Object-level security"] C --> D["Column-level security"] D --> E["Row-level security"]
mindmap
root((Access))
Workspace
Admin
Member
Contributor
Viewer
Item
Permission on one item
Data
Row-level security
Column-level security
Dynamic data masking
Governance
Sensitivity labels
Domainsflowchart TD
Q{"What does the user need?"}
Q -->|"One item"| A0["Item permission"]
Q -->|"The whole workspace"| A1["Workspace role"]Key point: Item permission shares a single item.
Why the other options are wrong
- A. The Member role on the whole workspace
- Member reaches the whole workspace.
- C. Ownership of the capacity behind the workspace
- Capacity ownership reaches far more.
- D. The Admin role on the whole workspace
- Admin reaches the whole workspace.