There is a rule that looks like this, see below. By default Authenticated Users is the principal type. If like in the example below you assign a certain group, only members of this group can run programs. Other users will receive an error when they try too. There is a similar rule for background processing using the ObjectURI /studio/sessions/*/background/submissions. By default Authenticated Users are allowed to do this.   This might help, however you still have the complete SAS Studio GUI available which might be a bit to much for the casual data viewer. Also what was mentioned before about ACCESS=READONLY is important. As an alternative have a look at https://datacontroller.io It might just do what you need (I do not have personal experience with it).  ... View more