When content permissions are not locked to the project, Tableau Server uses a delegated administration model. In this model, the user who owns the content (the workbook's owner) has the authority to manage its permissions. Additionally, users assigned the Project Leader role for the project containing the workbook are granted administrative capabilities over all content within that project, which includes setting permissions. This allows for granular control over individual assets by those most familiar with them.

A. Users that have the project and workbook Viewer role: The Viewer role is strictly for consumption. Users with this role can only view published content and have no administrative capabilities, including editing permissions.

B. Users that have the workbook Interactor role: The Interactor role allows users to interact with views (e.g., filter, sort, download data) but does not grant permissions to change the security or access rules for the workbook.

1. Tableau Server Help, "Set Permissions on Individual Content": This document explicitly states, "To set permissions on content, you must be an administrator, or have one of the following user roles: Project Owner, Project Leader, or a content owner." This directly supports that both the workbook's owner (content owner) and the Project Leader can edit permissions.

2. Tableau Server Help, "Projects and Content Permissions": Under the section "Who can set permissions," it clarifies that when permissions are customizable (not locked), "Content owners and project leaders (and administrators) can modify permission rules for their content." This confirms the roles of both the owner and Project Leader in this scenario.

3. Tableau Server Help, "Permissions Capabilities": This reference details the capabilities granted by different roles. It shows that the "Set Permissions" capability is not granted to the Viewer or Interactor site roles by default, reinforcing why options A and B are incorrect.