Manage access
Note
Grafana Workflows is currently in private preview. Grafana Labs offers support on a best-effort basis, and breaking changes might occur prior to the feature being made generally available.
The Workflows app uses Grafana’s role-based access control (RBAC) to gate access to workflow definitions, run events, and secrets. Use this page to understand which role grants which capability and how to assign roles in Grafana Cloud.
Plugin roles
The Workflows app declares four RBAC roles. Grafana assigns each role to one or more basic roles by default. An org admin can override the assignment for any user from the RBAC settings UI.
What each role grants
- Workflows Reader can open the Workflows app, browse the Workflows List, and view a workflow definition in read-only mode. They cannot create, edit, run, or delete workflows.
- Workflows Writer can do everything Workflows Reader can, plus create new workflows, edit existing ones, click Run to trigger a workflow manually, and delete workflows.
- Events Reader can see the Latest runs panel and inspect step inputs and outputs from completed runs.
- Events Writer can additionally trigger run events that drive the in-editor experience. Most customers do not need to grant this role manually because the basic Editor and Admin roles already include it.
What customers see when access is missing
When a user lacks the required permission, the Workflows app keeps the affected control visible but disables it and shows a tooltip explaining why. The tooltips include:
- “You do not have permission to create a workflow”
- “You do not have permission to edit this workflow”
- “You do not have permission to execute this workflow”
- “You do not have permission to add steps to this workflow”
- “You do not have permission to delete this workflow”
If a user with Workflows Reader opens the editor, the Save, Run, Enable, and + controls are disabled with the matching tooltip.
Manage access in Grafana Cloud
To assign a Workflows role to a user or team:
- In Grafana, navigate to Administration > Users and access > Users (or Teams).
- Select the user or team you want to update.
- In the Permissions section, add or remove Workflows Reader, Workflows Writer, Events Reader, or Events Writer as needed.
You can also assign these roles through the Grafana Cloud RBAC API.
Manage access to secrets
The in-plugin Secrets page is gated by Grafana’s secret service permissions, which are separate from the Workflows plugin roles:
A user must have these permissions in addition to a Workflows role in order to manage secrets from the Secrets page. For details on how Workflows uses these secrets, refer to Manage secrets.
