docs: correct the locked-project restriction and document the undocumented sync limits

README.md

@@ -46,8 +46,8 @@ baton resources
 - **Users** — All users on the site with email, site role, auth setting, and last login
 - **Groups** — Tableau groups with membership information
 - **Licenses** — License tiers (Creator, Explorer, Viewer, Unlicensed) with role-based assignment and purchased/consumed seat counts
-- **Projects** — Tableau projects with Read/Write permission assignments for users and groups
-- **Workbooks** — Tableau workbooks with 15 granular permission assignments for users and groups
+- **Projects** — Tableau projects with `View` and `Publish` permission assignments, plus the 16 `Workbook / ...` permissions that apply to the workbooks inside the project, for users and groups
+- **Workbooks** — Tableau workbooks with 16 granular permission assignments for users and groups
 - **Views** — Individual dashboards/views with granular permissions (inherited from workbook when `showTabs=true`)
 
 `baton-tableau` supports the following provisioning operations:
@@ -59,8 +59,8 @@ baton resources
 | Site Roles | Grant/Revoke | Assign/remove site-wide roles (Creator, Explorer, SiteAdministratorCreator, etc.) |
 | Licenses | Grant/Revoke | Assign/remove license tiers by updating site role |
 | Groups | Grant/Revoke | Add/remove users from groups |
-| Projects | Grant/Revoke | Assign/remove Read, Write permissions for users and groups |
-| Workbooks | Grant/Revoke | Assign/remove 15 granular permissions for users and groups |
+| Projects | Grant/Revoke | Assign/remove the `View` and `Publish` project permissions, plus the 16 `Workbook / ...` default workbook permissions, for users and groups |
+| Workbooks | Grant/Revoke | Assign/remove 16 granular permissions for users and groups |
 | Views | Grant/Revoke | Assign/remove view permissions for users and groups (when `showTabs=false`) |
 
 ## Important Notes
@@ -69,8 +69,8 @@ baton resources
 - **showTabs**: When a workbook has `showTabs=true`, view-level permissions are inherited from the workbook and cannot be modified independently. Grant/Revoke on those views are blocked with a descriptive error.
 - **Views in Personal Space**: Workbooks in a user's Personal Space (not under any project) are not synced, and therefore their views are not synced either.
 - **Server Administrators**: Users with `ServerAdministrator` site role are skipped during group membership sync (server-level admins are not site-scoped).
-- **Grant expansion**: Group-based permissions on projects, workbooks, and views are supported. When a group has a permission, all members inherit it.
-- **"All Users" group**: Tableau automatically adds every user to the built-in "All Users" group. This group cannot be modified via the API — Grant and Revoke operations on it are not supported. The connector syncs its membership to show each user's base site role.
+- **Grant expansion**: Group-based permissions on projects, workbooks, and views are supported. When a group has a permission, all members inherit it. Revoking such a permission from a single member does not remove their access: Tableau has no user-level assignment to remove, so the revoke returns `GrantAlreadyRevoked` and the next sync derives the permission from the group again. Revoke from the group, or remove the user from the group.
+- **"All Users" group**: Tableau automatically adds every user to the built-in "All Users" group. This group cannot be modified via the API: Grant is a no-op because the user is already a member, and Revoke returns an error. The connector syncs its membership to show each user's base site role.
 - **License revoke constraints**: Revoking a license (setting a user to "Unlicensed") will fail if the user belongs to a group with a "Grant role on sign in" minimum site role. Remove the user from the constraining group first, then revoke the license.
 - **Locked project names**: Inherited workbook grants for locked projects are found by filtering workbooks on the project name, and Tableau rejects filters containing commas (`,`) or ampersands (`&`). Locked projects whose names contain these characters are skipped for inherited workbook grants and a warning is logged. Rename those projects to sync their inherited access.
 - **Idempotency**: Granting a permission that already exists returns success (not an error). Revoking a permission that is already removed also returns success.

docs/connector.mdx

@@ -1,8 +1,8 @@
 ---
 title: Set up a Salesforce Tableau connector
 og:title: Set up a Salesforce Tableau connector - C1 docs
-og:description: Integrate your Salesforce Tableau instance with C1 to run user access reviews, enable just-in-time access requests, and easily provision and deprovision access.
-description: C1 provides identity governance for Salesforce Tableau. Integrate your Salesforce Tableau instance with C1 to run user access reviews (UARs) and enable just-in-time access requests.
+og:description: C1 provides identity governance and just-in-time provisioning for Salesforce Tableau. Integrate your Salesforce Tableau instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.
+description: C1 provides identity governance and just-in-time provisioning for Salesforce Tableau. Integrate your Salesforce Tableau instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.
 sidebarTitle: Salesforce Tableau
 ---
 
@@ -20,6 +20,12 @@ sidebarTitle: Salesforce Tableau
 
 The Tableau connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning).
 
+**Notes:**
+
+- Workbooks in a user's Personal Space don't belong to a project, so C1 doesn't sync them or their views.
+- C1 syncs membership of the built-in **All Users** group but can't change it, because Tableau doesn't allow that group to be modified through the API.
+- C1 doesn't show users with the **Server Administrator** site role as group members.
+
 ## Licenses and seats
 
 In Tableau, licensing is role-based: each user's **site role** determines their license tier. There is no separate license object to assign — granting a license means setting the user's site role. The connector surfaces four tiers:
@@ -33,20 +39,30 @@ In Tableau, licensing is role-based: each user's **site role** determines their
 When your Tableau site has per-tier seat capacities configured, C1 tracks the purchased and consumed seat counts for each license tier, so you can review license utilization alongside who holds each tier.
 </Note>
 
+<Note>
+Revoking a license fails if the user belongs to a group with a **Grant role on sign in** minimum site role. Tableau returns `Site role of link user that belongs to license upon login cannot be lower than minimum site role of group`. Remove the user from that group first, then revoke the license.
+</Note>
+
 ## Permission inheritance
 
 Tableau uses a permission inheritance model that affects how access is synced and provisioned:
 
 - **Projects with `LockedToProject`**: When a project's content permissions are set to `LockedToProject`, workbooks inside that project inherit the project's permissions and cannot be granted or revoked independently — permissions must be changed at the project level instead.
 
-<Warning>
-Tableau does not allow commas (`,`) or ampersands (`&`) in the project names the connector uses to find a project's workbooks. If a project with locked permissions has one of these characters in its name, C1 can't sync the access its workbooks inherit from that project. We recommend renaming these projects without commas or ampersands.
-</Warning>
-
 - **Workbooks with `showTabs=true`**: Views (dashboards) inside these workbooks inherit their permissions from the workbook. View-level permissions cannot be granted or revoked independently — attempting to do so returns a clear error. Use the workbook entitlement instead.
 
 - **Workbooks with `showTabs=false`**: Views have their own independent permission assignments, which can be granted and revoked directly.
 
+- **Permissions granted to a group**: Every member of the group holds the permission, and C1 shows the group as the source of each member's grant.
+
+<Note>
+If a locked project's name contains a comma (`,`) or an ampersand (`&`), C1 doesn't sync the access its workbooks inherit from that project, because Tableau rejects these characters in the filter the connector uses to find them. Rename those projects without commas or ampersands to sync their inherited access.
+</Note>
+
+<Note>
+Revoking a permission from a user who holds it only through a group doesn't remove their access: the next sync shows it again, granted through the group. Revoke the permission from the group, or remove the user from the group.
+</Note>
+
 ## Gather Tableau credentials 
 
 Configuring the connector requires you to pass in credentials generated in Tableau. Gather these credentials before you move on.