Dashboards & allowlists
Workstation: Dashboards → Register dashboards (+ runtime builder)
Overview
- Build and publish dashboard in analytics runtime (operator builder)
- Enable embed in runtime; set Allowed Domains
- Register dashboard on control plane; set iframe parent origins
Skip any step → embed forbidden, blank iframe, or wrong tenant data.
Build in runtime builder
Open Dashboard builder in the Operator console sidebar (SSO, operator-only).
| Rule | Why |
|---|---|
| Every chart dataset includes tenant column | RLS at session mint |
Do not hard-code WHERE tenant = 'x' in SQL | Isolation is per-session |
| Prefer single-page dashboards | Cleaner embed |
| Publish before embed enable | Drafts not embeddable |
White-label: No tabs/SQL Lab for end-users — guest role restricts builder features. WHITE_LABEL_EMBED.md
Enable embed in runtime
- Dashboard → ⋮ → Embed dashboard
- Enable embed; copy embedded dashboard UUID
- Allowed Domains — add every origin that loads embeds:
https://app.yourcompany.com
http://localhost:3000
https://embeddedcanvas.com
Exact match: scheme + host + port, no trailing slash.
Register on control plane
Dashboards workstation → Register dashboards
| Field | Value |
|---|---|
| Superset embed UUID | From embed modal |
| Display name | Shown in registry / portal |
| packKey | Optional stable id for integrator |
| Iframe parent origins | Same origins as Allowed Domains |
Copy embed token (UUID) for engineering handoff.
Dual allowlist (required)
| # | Where | Controls |
|---|---|---|
| 1 | Dashboards → Iframe parent origins | Hosted shell frame-ancestors |
| 2 | Runtime → Embed → Allowed Domains | Direct runtime iframe (SDK path) |
Both lists must match your app staging + production origins.
Negative test: load from unlisted origin → blocked .
RLS proof (before handoff)
Analytics → view-as tenant A, then B — metrics must differ.
Or Embed portal (/portal) RLS test buttons.
Same tenant twice → identical data. Empty chart for a tenant with no rows is OK; same data as another tenant is not.
Guest permissions
If embed returns Forbidden after allowlist fix, operator runs inside workspace container:
python3 /app/pythonpath/grant-guest-embed-perms.py
Playbook: fix-superset-embed-forbidden.md
Optional (P1)
| Feature | Where |
|---|---|
| Custom embed domain | Analytics advanced → DNS + allowlist update |
| Tenant catalog | Restrict dashboards per tenant at session mint |
| Dashboard pack import | Analytics advanced / GitOps |
Deep reference
- End-to-end — Phase 3
- CSP_EMBED_HARDENING.md
- RLS_E2E.md