Add dashboard filter support to user attributes docs (#565)

Author: rephus

images/references/workspace/user-attribute-dashboard-filter.png

@@ -54,7 +54,7 @@ User attributes can be used in these specific contexts within the model.yaml fil
 
 User attributes can also be used in:
 
-- **Chart filter values** - Filter charts dynamically based on the logged-in user
+- **Chart and dashboard filter values** - Filter charts and dashboards dynamically based on the logged-in user
 
 <Info>
   User attributes cannot currently be referenced inside`sql:` tags within the model YAML files.
@@ -111,9 +111,9 @@ When referencing user attributes in SQL you can use the following [SQL variables
   If you are self hosting you can enable [SMTP](/self-host/customize-deployment/configure-smtp-for-lightdash-email-notifications) or [SSO](/self-host/customize-deployment/use-sso-login-for-self-hosted-lightdash) authentication to allow users to verify their email address.
 </Info>
 
-### Using user attributes in chart filter values
+### Using user attributes in chart and dashboard filter values
 
-You can reference user attributes directly in chart filter values to create dynamic filters based on the logged-in user. This is useful for creating charts that automatically filter to show only data relevant to the current user.
+You can reference user attributes directly in chart and dashboard filter values to create dynamic filters based on the logged-in user. This is useful for creating charts and dashboards that automatically filter to show only data relevant to the current user.
 
 To use a user attribute in a filter value, enter one of the following references:
 
@@ -122,12 +122,20 @@ To use a user attribute in a filter value, enter one of the following references
 
 For example, if you have a chart showing sales data and you want each user to only see their own records, you can add a filter where `sales_rep_email` is equal to `${lightdash.user.email}`. When the chart runs, the filter value will be replaced with the actual email of the logged-in user.
 
+The same references work on dashboard filters, so a single dashboard can be shared with many users and each will only see the rows relevant to them.
+
+![Dashboard filter using a user attribute as its value](/images/references/workspace/user-attribute-dashboard-filter.png)
+
 Similarly, you can use custom attributes like `${lightdash.attribute.country}` to filter data based on a user's assigned region or department.
 
 <Info>
   If a user attribute referenced in a filter value is not set for the current user, the query will return a `Forbidden` error.
 </Info>
 
+<Warning>
+  Chart and dashboard filters are **not a security boundary**. Any user with edit access to the chart or dashboard can remove or change the filter and see the underlying rows. If you need to actually restrict which rows a user can query, use [row filtering with `sql_filter`](#row-filtering-with-sql%5Ffilter) in your dbt model — that runs on the warehouse and cannot be bypassed from the UI.
+</Warning>
+
 ### Row filtering with `sql_filter`
 
 Row-level security (RLS) in Lightdash is implemented using the `sql_filter` property combined with user attributes. This allows you to restrict which rows each user can see based on their attributes.