Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Restricting Metabase securely requires two controls working together: Metabase permissions decide what an authenticated Metabase user can access, while embedding authorization decides which dashboard or component an external page is allowed to load. Remove broad group access, grant only the database, collection and application privileges each audience needs, then choose authenticated or guest embedding according to whether Metabase must know the viewer’s identity. Guest JWTs authorize a read-only embed but do not create a Metabase user session, so tenant filtering for guests must be enforced by your application and locked parameters.
What “restricting Metabase access” actually covers
Dashboard visibility is only one part of Metabase’s security model. The permissions overview separates access into three surfaces: data permissions for databases, schemas and tables; collection permissions for saved questions, dashboards and other content; and application permissions for features. A user can be blocked from a dashboard yet still have an unnecessarily broad database privilege, or be able to query data while lacking access to the collection that stores the approved dashboard. Review all three surfaces for every audience.
As an Amazon Associate I earn from qualifying purchases.
| Security surface | What it controls | What to review |
|---|---|---|
| Data permissions | Access to databases, schemas and tables | Which groups can query each data source and whether write or SQL capabilities are needed |
| Collection permissions | Access to saved questions, dashboards and other saved content | Whether a group can view, edit, curate or share the relevant collections |
| Application permissions | Eligibility for Metabase features | Whether a user can use features that could expose, alter or redistribute data |
| Embedding authorization | Whether an external page may load a particular embedded resource | Which embedding mode is used and how the embed is authenticated |
Metabase documents these permission categories in its permissions overview. Treat the embedding decision as a separate authorization boundary rather than assuming that a visible dashboard is automatically protected.
Start with the audience and data layout
Before changing permissions or generating tokens, write down who will view the content and where each tenant’s records live. The answer determines which controls are available and where enforcement must occur.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Classify viewers. Decide whether they already have Metabase accounts, will sign in through your identity provider, or are external viewers with no Metabase identity.
- Map the data. Record whether customers share tables, use separate schemas, or have a separate database per tenant.
- Record query capabilities. Identify whether any audience can create native SQL questions. SQL access is a separate trust boundary from Metabase’s row-and-column filters.
- List the resources to expose. Name the databases, tables, collections, dashboards and individual components required by each audience.
- Document tenant attributes. For authenticated users, identify the user attributes that will drive filtering and where those values are maintained.
Metabase describes the available data-isolation choices in its data isolation methods documentation. Do this inventory before designing a token or group: a shared table and a separate-database architecture cannot use the same isolation strategy.
Remove broad defaults before granting exceptions
Metabase permissions are group-based. A person may belong to several groups, and Metabase says the most permissive privilege inherited from those memberships applies. A carefully restricted customer group therefore cannot undo a broad privilege inherited through another group.
Audit the All Users group
Open the permissions administration area and inspect the All Users group for every database, schema, table, collection and feature relevant to the deployment. Remove access that no audience genuinely needs. This is usually safer than trying to compensate for a broad default with a narrower group.
Create purpose-built groups
Use groups that represent an actual access need, such as internal analysts, support staff, customer viewers or dashboard editors. Grant each group only the resources and actions required for its job. Keep authoring privileges separate from read-only viewing, and keep administrative access out of customer-facing groups.
Check combined membership
For every person who will test the deployment, list all group memberships, including groups assigned indirectly by an identity provider. Compare the effective result with the intended policy. A user who appears restricted in one group can still receive broader database or collection access from another.
The group-inheritance behavior and permission configuration process are covered in Metabase’s full app embedding guidance and the permissions overview.
Choose an embedding mode that matches viewer identity
| Viewer situation | Suitable pattern | Control that protects the data |
|---|---|---|
| The viewer has a Metabase identity | SSO, modular embedding or full app embedding | Metabase evaluates that account’s groups, permissions and user attributes |
| The viewer has no Metabase account and needs one fixed, read-only dashboard | Guest embedding with a server-signed JWT | The backend authorizes the embed resource; the host application controls who receives it |
| A guest dashboard must show tenant-specific rows | Guest embedding with locked parameters | The host authenticates and authorizes the tenant, then signs parameters that cannot be changed by the browser |
| Each tenant owns a separate database | Authenticated embedding with database routing, where eligible | Routing selects the tenant database after the user is authenticated |
| Users must run native SQL | Database-enforced controls or connection impersonation | The database account or impersonated identity enforces SQL access; Metabase row-and-column rules are not the safeguard |
Metabase’s embedding introduction describes authenticated and guest approaches. Select the mode before building the page integration; changing from guest to authenticated embedding later changes both the identity flow and the data-isolation design.
Free tools Windows power users keep installed
One-click scans. No signup required.
Authenticated embedding: make Metabase permissions follow the user
Use authenticated embedding when the host application needs Metabase to apply a person’s permissions. In SSO, modular embedding or full app embedding, the application signs the person into a corresponding Metabase account. Metabase can then evaluate group membership, collection access, data permissions and user attributes for that account.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Implementation sequence
- Create or map the Metabase account. Ensure the identity-provider or application identity maps consistently to a Metabase user.
- Assign least-privilege groups. Put the user in only the groups required for the embedded content and remove conflicting memberships.
- Grant data and collection access. Give the groups access to the specific database objects and collections used by the embed. Do not treat dashboard visibility as a replacement for database permissions.
- Configure user attributes. Supply the tenant or business-unit value used by row-and-column security, and verify its spelling and case.
- Embed the approved resource. Use the authenticated embedding flow documented for the chosen integration and prevent the host page from exposing resources outside the user’s intended scope.
Metabase’s full app embedding quickstart specifically calls for testing as a non-admin. Follow that principle for every authenticated integration: administrators can bypass restrictions and are not representative of customer or analyst access.
Guest embedding: what a signed JWT does—and does not do
A guest embed uses a backend-generated, signed JSON Web Token to authorize an embedded resource and any signed parameters. It does not create a Metabase user session. Metabase therefore has no guest identity on which to evaluate group permissions, user attributes, or row-and-column security.
Safe guest-embed flow
- Authenticate the viewer in your application. Determine who is requesting the page and which tenant that account is allowed to access.
- Authorize the requested resource. Check that the viewer may see the specific dashboard or component, not merely that they are logged in.
- Generate the JWT on the server. Keep the signing key out of browser code and sign only the resource and parameters needed for that request.
- Lock tenant parameters. Bind the tenant filter to the server-verified identity so the browser cannot replace it with another tenant value.
- Deliver the embed. Treat the token as an authorization artifact for that resource, not as proof that Metabase knows the viewer.
- Test tampering and expiry behavior. Attempt to alter parameters, reuse a token for another resource and access the page after the token’s intended lifetime.
Metabase explains this boundary in Securing embedded Metabase. A valid JWT can authorize an embed while the host application still has the responsibility to authenticate the person and enforce tenant authorization.
Why guest embeds cannot provide Metabase row security
Row-and-column security depends on a Metabase user and that user’s attributes. A guest token has no such identity, so adding a tenant claim to a token does not make Metabase evaluate its normal row-security rules. The secure pattern is host-side authorization plus a locked parameter whose value is derived from the authorized account.
Prefer guest embedding over legacy static embeds
Metabase recommends the newer guest-embedding approach rather than static embedding. Static embeds lack row-and-column security and user-specific session analytics, making them unsuitable when access must vary by user or tenant. Existing static integrations should be treated as migration candidates, not as a way to add identity-aware controls.
Choose tenant isolation according to the database design
| Data layout or requirement | Candidate control | Important qualification |
|---|---|---|
| Tenants share tables or schemas and users have Metabase identities | Row-and-column security or database impersonation | Attributes must be correct; feature scope and SQL behavior must be checked |
| Each tenant has a separate database | Database routing | Confirm that the deployed plan and version support the routing configuration |
| Guests need tenant-specific views | Locked parameters in a guest embed | Host authentication and authorization are mandatory because guests have no Metabase identity |
| Users can write native SQL | Database-enforced roles or connection impersonation | Metabase row-and-column security does not apply to native SQL questions |
Shared tables: row-and-column security
For authenticated users, row-and-column security can restrict which rows or columns a user sees based on user attributes. Metabase notes that attribute matching can be exact and case-sensitive. Normalize values at the identity source and test capitalization, whitespace and tenant identifiers with representative accounts.
Review the limitations in Metabase’s row and column security documentation before relying on it for every query path. In particular, do not assume that a filter applied to a dashboard also protects an unrestricted native SQL question.
Recommended Free Tools
Connection impersonation
Database impersonation can move enforcement closer to the database by connecting as, or on behalf of, an identity with database-level privileges. It is worth considering when the database already has mature role controls or when SQL access must be governed outside Metabase. Configure and test the database roles independently; an impersonation design is only as restrictive as those roles.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Separate databases: routing
When each tenant has its own database, database routing can select the appropriate connection for an authenticated user. Confirm routing rules, fallback behavior and plan eligibility before production. A routing error that falls back to a shared or default database can expose more data than intended.
Native SQL is a separate trust boundary
Metabase documents that row-and-column security does not apply to native SQL queries. SQL access may use the authority of the database connection account, so a user who can create or run unrestricted SQL can bypass a dashboard’s visual filters. Restrict native SQL capability, place sensitive SQL questions in admin-only collections where appropriate, and use database roles or impersonation when SQL is a business requirement.
These distinctions are detailed in Data isolation methods and the row-and-column security guide.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Protect collections and sharing paths
A dashboard can be correctly filtered yet still be exposed through its saved questions, collection or sharing settings. For each audience, review whether the group may view, edit, curate or share the collection. Separate authoring collections from customer-facing collections, and avoid giving external viewers permission to create content against sensitive databases.
Do not use public sharing for data that needs user-specific security. Metabase’s troubleshooting guidance warns that public questions cannot be secured by user attributes or group information because the viewer is not logged in. If the result must vary by person or tenant, use authenticated embedding or a guest embed with host authorization and locked parameters instead.
Check application permissions as well as collection permissions. A feature that allows downloading, SQL editing or broader exploration can turn a narrowly designed dashboard into an unintended data-extraction path.
Validate the design with non-admin accounts
Validation should test effective access, not just whether the page loads. Use representative accounts from every group combination, including at least one account with the least privilege expected in production.
- Confirm that each account sees only the intended dashboards, collections and database objects.
- Check a shared-table tenant filter with at least two tenant identities, including values that differ only in letter case if case sensitivity is relevant.
- Attempt to alter a guest parameter in the browser and verify that the signed, locked value cannot be changed to another tenant.
- Test direct access to saved questions, collections and database browsers, not only the embedded dashboard URL.
- Try native SQL paths for every group that can access SQL and verify that database controls match the policy.
- Check overlapping group memberships and remove any privilege that appears only through an unintended group.
- Test expired, malformed, replayed or resource-mismatched guest tokens and confirm that the host denies unauthorized requests before issuing a new token.
- Repeat the checks after changing a user’s group or tenant attribute to verify that revocation takes effect as expected.
The non-admin testing approach follows the validation emphasis in Metabase’s full app embedding documentation. It is a recommended control procedure, not a substitute for reviewing the permissions configuration itself.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Common failure modes and fixes
A guest token is treated as an end-user identity
Symptom: The integration assumes that Metabase will apply the viewer’s group or row-security rules because the JWT contains a customer identifier.
Fix: Authenticate and authorize the viewer in the host application, derive the tenant value there, and sign it as a locked parameter. Do not describe the token as a Metabase login.
All Users silently restores access
Symptom: A restricted group appears to have correct settings, but a test account can still open data or collections that should be blocked.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFix: Inspect the All Users group and every other group assigned to the account. Remove the broad privilege or move the account to a purpose-built membership set.
Row security is expected to protect native SQL
Symptom: Dashboard cards are filtered correctly, but a SQL-capable user can query rows outside the intended tenant.
Fix: Treat SQL as a separate trust boundary. Remove SQL capability where it is not required and enforce restrictions with database roles, connection impersonation or other database-native controls.
User attributes do not match
Symptom: An authenticated user receives no rows or receives another tenant’s rows after a filter change.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Fix: Compare the actual attribute value with the value stored in the data, including capitalization and whitespace. Metabase documents exact, potentially case-sensitive matching; test with a representative account rather than an administrator.
Public sharing is used for personalized data
Symptom: A public link is expected to identify the viewer or apply group-based restrictions.
Fix: Replace public sharing with authenticated embedding, or use guest embedding with host authorization and locked parameters. A public viewer is not logged into Metabase for attribute-based enforcement.
Legacy static embedding remains in production
Symptom: The embed works, but there is no user-specific security or session analytics.
Fix: Plan a move to guest embedding for fixed, read-only external views or authenticated embedding when Metabase must apply user permissions.
Metabase collects these troubleshooting boundaries in its row-and-column security troubleshooting guide and embed security documentation.
Verify plan and version eligibility
Embedding and isolation capabilities are not identical across Metabase editions. Current documentation states that row-and-column security and several data-isolation methods are available on Pro or Enterprise, while guest authentication is also available on OSS and Starter. Entitlements and configuration details can change, so verify the documentation for the exact Metabase release and plan deployed in your environment before committing to an architecture.
Record the release, edition and enabled features as part of the access design. Recheck them after upgrades, especially when relying on row-and-column security, database routing or impersonation. The current embedding permissions page and data-isolation methods page are the appropriate starting points for that verification.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA practical decision sequence
- Need Metabase to enforce a person’s permissions? Use authenticated embedding and ensure the person has the correct Metabase account, groups and attributes.
- Need a fixed read-only dashboard for viewers without Metabase accounts? Use guest embedding, sign the JWT on your server and restrict the exposed resource.
- Need tenant-specific guest data? Keep tenant authorization in the host application and use locked parameters; do not rely on Metabase row security for guests.
- Share tables among authenticated tenants? Evaluate row-and-column security or database impersonation, then test attribute matching and SQL limitations.
- Use one database per tenant? Evaluate database routing and verify plan support, fallback behavior and connection isolation.
- Allow native SQL? Reassess whether the database, rather than Metabase dashboard filters, must enforce the boundary.
- After implementation? Test with non-admin accounts, inspect effective group privileges, attempt cross-tenant access and repeat the checks after identity or plan changes.
The secure result is not a particular token format or a single permission switch. It is a design in which Metabase permissions protect authenticated users, the host application protects guest identity and tenant authorization, and the database supplies an additional enforcement layer wherever SQL or shared data makes dashboard-level controls insufficient.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
