When you add a user to the site, you assign one of the following site roles: Server Administrator, Site Administrator, Publisher, Interactor, or Viewer. The administrator site roles get all permissions available for a site, regardless of the content permissions you set for those users.
For Publisher, Interactor, or Viewer, the site role determines the maximum permissions that a user will ever have on content. For example, if a user is assigned the Viewer site role, that user can never publish, no matter what permissions you grant that user on the site. Nor can that user be given permissions to interact with content.
Some users always have full access to content on your site, regardless of the permissions that you set on content. Full access means that the user can do everything with that content. The following types of users get full access to content:
Server administrators and site administrators. Users who have these site roles can access all content, anywhere on the site.
Content owners. When users with the site role of Publisher publish content to Tableau Server, by default, they become content owners for their published content. Content owners can set the refresh schedule and priority, edit, remove, save, and set permissions on their content.
Project leaders. Though it might sound like a site role, Project Leader is a project capability that can be set to Allowed. If you make someone a project leader, that person gets full access to all content published to the project. For more information.