Documentation Grafana Cloud AI and machine learning Grafana Assistant Privacy and security Manage access (RBAC)

Manage Assistant access with RBAC

Grafana Assistant relies on Grafana Cloud role-based access control (RBAC) so you can decide who can chat, run investigations, or administer tenant-wide settings. This article explains the roles available, the permissions they unlock, and how to grant users the access they need.

Before you begin

• Organization administrator access: Only admins can assign Grafana Cloud roles.
• RBAC plan: Decide which teams need chat, investigations, or administrative control.
• Feature availability: Confirm you enabled Grafana Assistant and investigations in your stack.
• Scope per stack: RBAC applies within a Grafana Cloud stack. Use plugins.app:access scoped to plugins:id:grafana-assistant-app to control who can open Assistant in that stack. To remove or disable the Assistant in a specific stack, an administrator can navigate to Administration > Plugins and data > Plugins, search for Grafana Assistant or go directly to /plugins/grafana-assistant-app, uncheck the agreement box, and click Save.

Understand available roles

Grafana Cloud offers baseline organization roles plus Assistant-specific roles. Combining them lets you tailor access without granting more privileges than necessary.

Organization roles define broad access in Grafana Cloud:

Assistant-specific roles extend or restrict access regardless of the user’s organization role:

Assign Assistant-specific roles to give targeted access to teammates who are not Editors or Admins.

Grant access in Grafana Cloud

Use the following procedures to grant the right level of access without over-provisioning.

Grant basic Assistant chat access

1. Sign in as an organization administrator.
2. Go to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant User.
5. Click Apply.

Allow users to launch investigations

1. Sign in as an organization administrator.
2. Navigate to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant Investigation User.
5. Click Apply.

Allow users to view system-created investigations

System-created investigations are launched automatically by IRM webhooks, alerts, or incidents. By default, only organization Admins can view them. This role is additive — the user also needs the Assistant Investigation User role for general investigation access.

1. Sign in as an organization administrator.
2. Navigate to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant Investigation User (if not already assigned).
5. Also choose Assistant > Assistant System Investigation Viewer.
6. Click Apply.

Delegate Assistant administration

1. Sign in as an organization administrator.
2. Navigate to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant Admin.
5. Click Apply.

Users can hold multiple Assistant roles if they need both investigation access and tenant-wide configuration control.

Map permissions to actions

Each Assistant role grants a set of permissions. Use the tables below when you need to understand or audit the underlying RBAC settings.

Core permissions

Actions and required permissions

Permissions with a * suffix mean the role needs read, create, write, and delete access for that feature area.

Next steps

• Review Manage your data privacy and security to understand data handling, third-party providers, security measures, and access controls.
• Review Pricing and limits to understand projected costs and limits.