Forum Discussion
Update object level security (OLS) roles
There's a very detailed table available here: Roles in the new workspaces in Power BI - Power BI | Microsoft Docs
If a workspace member was a viewer but had build permissions on the dataset they could build a report on the dataset in power bi desktop or in the service and save to their "My Workspace".
But yes your last sentence is correct.
Trying to pick up a few of your questions:
1) From:
https://docs.microsoft.com/en-us/power-bi/admin/service-admin-rls
"Workspace members assigned Admin, Member, or Contributor have edit permission for the dataset and, therefore, RLS doesn’t apply to them."
This also applies to OLS.
2) If a user is a member of more than one role you end up with a UNION of the permissions - it only ever increases access and never takes it away.
3) To my knowledge you can't configure notifications when permissions are changed. (Might be able to wire something up with the API but I'm not familiar enough with it).
Have you considered housing the dataset in one workspace with very locked down access (those who are allowed to change role allocation) but giving users who need it direct build access? They can then build and publish reports ot other workspaces but won't have permission to edit role assignment.