Three of the four panels in Michael Nocito's diagram have no lines leaving the dashboard rectangle. The fourth, outlined in a warning color, has one, and it crosses the boundary to a separate box labeled third-party host [13]. On the dashboard itself, that fourth panel looks like the other three [13].
Tableau adds an extension as a dashboard object, which places it in the same family as a text box, an image or a web page object rather than in the same family as a sheet [6]. The object family describes how it is placed. What it can read is a separate question, settled by the permission model, which asks you to allow or deny the extension access to data in the workbook [8].
That is where the two tiers matter. A network-enabled extension may request the higher level, called Full Data Access [8]. One of the two levels gives the extension the full underlying data along with table and field names [9]. People picture the rows, but the names are what gets underweighted: a field name is not a fact about a customer, it is a fact about your model, and it leaves in the same grant as the extract [9].
So the dialog resolves one of the two variables that decide the risk, telling you the data scope [8][9] while staying silent on where the code runs: some extensions are hosted on Tableau-managed servers while others are hosted by whoever built them [3][4][14]. Nocito's framing is the right one: the panel's appearance is authored by the same people you would be trusting, so a polished panel is evidence of design effort, while where it runs is a fact about the software rather than a claim by it [12].
There is a configuration that answers the network question by removing the network. The sandboxed option runs an extension in an isolated environment with no access to the network outside, and it needs Tableau Server 2019.4 or later [10]. Below that version the sandbox is not available, which leaves the two hosting kinds Nocito describes and no setting that changes them [15].
Nocito is careful not to turn this into a verdict on network-enabled extensions: plenty of good tools are delivered that way, being outside Tableau's review service is not a mark against a developer, and the question simply moves to you, where it becomes the ordinary vendor question about anyone handling company data [11]. I agree with that reading, and in my context it produces a short rule. Prefer sandboxed hosting where the server version supports it [10]. Treat a Full Data Access request from a network-enabled panel as a data processor review rather than a click, and ask first whether the use case needs that tier at all. Write-back to a database from inside the dashboard is a case where it plausibly does; a chart type Tableau does not ship is a case where the answer is worth testing [7].
Establish the host before you grant the data, because the grant will not report the host [4].
