docs(security): credit dataset owners, clarify per-error-type placeholders

Contacts in the access-denied payload come from datasource.owners, and
PERMISSION_INSTRUCTIONS_LINK placeholders that don't apply to the
triggering error type render as empty strings — document both so a
single URL template can safely cover chart/dashboard and SQL Lab
denials.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/admin_docs/security/security.mdx

@@ -132,6 +132,33 @@ tables in the **Permissions** dropdown. To select the data sources you want to a
 You can then confirm with users assigned to the **Gamma** role that they see the
 objects (dashboards and slices) associated with the tables you just extended them.
 
+### Actionable Access-Denied Messages
+
+When a viewer opens a chart or dashboard built on a dataset they don't have access to, Superset
+shows a plain-language error naming the dataset (or tables, for SQL Lab) and, when known, the
+dataset owners to contact. You can also point users at your own access-request process by setting
+`PERMISSION_INSTRUCTIONS_LINK` in `superset_config.py`:
+
+```python
+PERMISSION_INSTRUCTIONS_LINK = (
+    "https://access.example.com/request?dataset={datasource_name}&table={table_names}&user={username}"
+)
+```
+
+The URL may include any of the following placeholders, which are substituted with URL-encoded
+values so the link can deep-link into an internal ticketing or access-request tool with the
+denied resource pre-filled:
+
+- `{datasource_id}` — id of the denied dataset (chart/dashboard errors only)
+- `{datasource_name}` — name of the denied dataset (chart/dashboard errors only)
+- `{table_names}` — comma-separated denied table names (SQL Lab/table errors only)
+- `{username}` — the requesting user's username
+
+Only the placeholders that apply to the triggering error type are filled in; the rest are replaced
+with an empty string, so a single URL template can cover both chart/dashboard and SQL Lab denials.
+A URL with no placeholders is used as-is, and leaving `PERMISSION_INSTRUCTIONS_LINK` unset (the
+default) omits the "Request access" link, falling back to owner-contact guidance.
+
 ### Subjects
 
 A **subject** is a unified identity that can be granted access to Superset resources such as