---
title: "Manage access | Grafana Cloud documentation"
description: "Grant Grafana Workflows access to your team using the plugin's RBAC roles for workflow definitions, run events, and secrets."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Manage access

> Note
> 
> Grafana Workflows is currently in [private preview](/docs/release-life-cycle/). Grafana Labs offers support on a best-effort basis, and breaking changes might occur prior to the feature being made generally available.

The Workflows app uses Grafana’s role-based access control (RBAC) to gate access to workflow definitions, run events, and secrets. Use this page to understand which role grants which capability and how to assign roles in Grafana Cloud.

## Plugin roles

The Workflows app declares four RBAC roles. Grafana assigns each role to one or more basic roles by default. An org admin can override the assignment for any user from the RBAC settings UI.

Expand table

| Role             | Description                              | Default basic role assignment | Permission actions                                      |
|------------------|------------------------------------------|-------------------------------|---------------------------------------------------------|
| Workflows Reader | Read workflow definitions.               | Viewer                        | `grafana-workflows-app.workflows:read`                  |
| Workflows Writer | Create, edit, run, and delete workflows. | Editor, Admin                 | `grafana-workflows-app.workflows:read`, `:write`        |
| Events Reader    | Read workflow run events.                | Viewer, Editor, Admin         | `grafana-workflows-app.workflows-events:read`           |
| Events Writer    | Create and manage workflow run events.   | Editor, Admin                 | `grafana-workflows-app.workflows-events:read`, `:write` |

### What each role grants

- **Workflows Reader** can open the Workflows app, browse the **Workflows List**, and view a workflow definition in read-only mode. They cannot create, edit, run, or delete workflows.
- **Workflows Writer** can do everything Workflows Reader can, plus create new workflows, edit existing ones, click **Run** to trigger a workflow manually, and delete workflows.
- **Events Reader** can see the **Latest runs** panel and inspect step inputs and outputs from completed runs.
- **Events Writer** can additionally trigger run events that drive the in-editor experience. Most customers do not need to grant this role manually because the basic Editor and Admin roles already include it.

## What customers see when access is missing

When a user lacks the required permission, the Workflows app keeps the affected control visible but disables it and shows a tooltip explaining why. The tooltips include:

- “You do not have permission to create a workflow”
- “You do not have permission to edit this workflow”
- “You do not have permission to execute this workflow”
- “You do not have permission to add steps to this workflow”
- “You do not have permission to delete this workflow”

If a user with **Workflows Reader** opens the editor, the **Save**, **Run**, **Enable**, and **+** controls are disabled with the matching tooltip.

## Manage access in Grafana Cloud

To assign a Workflows role to a user or team:

1. In Grafana, navigate to **Administration** > **Users and access** > **Users** (or **Teams**).
2. Select the user or team you want to update.
3. In the **Permissions** section, add or remove **Workflows Reader**, **Workflows Writer**, **Events Reader**, or **Events Writer** as needed.

You can also assign these roles through the [Grafana Cloud RBAC API](/docs/grafana-cloud/account-management/authentication-and-permissions/access-control/).

## Manage access to secrets

The in-plugin **Secrets** page is gated by Grafana’s secret service permissions, which are separate from the Workflows plugin roles:

Expand table

| Capability      | Permission action            |
|-----------------|------------------------------|
| List secrets    | `secret.securevalues:read`   |
| Create a secret | `secret.securevalues:create` |
| Update a secret | `secret.securevalues:write`  |
| Delete a secret | `secret.securevalues:delete` |

A user must have these permissions in addition to a Workflows role in order to manage secrets from the **Secrets** page. For details on how Workflows uses these secrets, refer to [Manage secrets](/docs/grafana-cloud/alerting-and-irm/workflows/manage-secrets).

## Next steps

- [Manage secrets](/docs/grafana-cloud/alerting-and-irm/workflows/manage-secrets)
- [Create workflows](/docs/grafana-cloud/alerting-and-irm/workflows/create-workflows)
- [Observe workflow runs](/docs/grafana-cloud/alerting-and-irm/workflows/observe-runs)
- [Troubleshoot workflows](/docs/grafana-cloud/alerting-and-irm/workflows/troubleshoot)