# Prevent javascript execution to users

**URL:** <https://community.dynatrace.com/t/prevent-javascript-execution-to-users/50332>\
**Category:** Open Q&A\
**Tags:** user-management, javascript, permissions\
**Created:** [February 19, 2025, 9:41am UTC](https://community.dynatrace.com/t/prevent-javascript-execution-to-users/50332 "2025-02-19T09:41:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![paco\_castillo](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/paco_castillo/32/13541_2.png) [@paco\_castillo](https://community.dynatrace.com/u/paco_castillo)\
**Post date:** [February 19, 2025, 9:41am UTC](https://community.dynatrace.com/t/prevent-javascript-execution-to-users/50332/1 "2025-02-19T09:41:26Z")

</div>

Hi Dynatrace community,

Is there a way to prevent users to execute javascript in apps? i.e Dashboards, workflows, notebooks etc…

The use case here is, we would need to prevent an user to create a javascript tile in the mentioned apps (to avoid malicious intents). Is there a permission in the policies for this?

The second use case is, can we prevent users to create a javascript tile but they can consume a dashboard/notebook/workflow that an user with elevated permissions have created?

Thanks!

Best regards,

Paco

---

<div class="post-metadata">

**Author:** ![erh\_inetum](https://avatars.discourse-cdn.com/v4/letter/e/48db29/32.png) [@erh\_inetum](https://community.dynatrace.com/u/erh_inetum)\
**Post date:** [February 20, 2025, 3:00pm UTC](https://community.dynatrace.com/t/prevent-javascript-execution-to-users/50332/2 "2025-02-20T15:00:29Z")

</div>

Hi Paco,

I think you can define a read-only IAM policy to the objects you need to.  
Ex.:  
ALLOW settings:objects:read, settings:schemas:read WHERE settings:schemaId IN (“builtin:dashboards.general”,“builtin:dashboards.presets”,“builtin:dashboards.image.allowlist”);  
ALLOW automation:workflows:read

However, someone may propose a more complete solution than mine.  
Hope it helps anyway.  
Regards,  
Elena.