Documentation Grafana Cloud Platform Assistant Privacy and security Manage access (RBAC)

Manage Assistant access with RBAC

Grafana Assistant relies on Grafana role-based access control (RBAC) so you can decide who can chat, run investigations, or administer deployment-wide settings. This article explains the roles available, the permissions they unlock, and how to grant users the access they need.

Before you begin

Decide who needs chat access, admin access, or investigation access before you start assigning roles.

• Organization administrator access: Only admins can assign Assistant-related roles and permissions.
• RBAC plan: Decide which teams need chat, investigations, or administrative control. For planning guidance, refer to Plan your Grafana RBAC rollout strategy.
• Feature availability: Confirm Assistant is available or enabled in your stack. Investigations require a separate entitlement.
• Scope per deployment: Assistant uses Grafana RBAC in the Grafana Cloud stack where the plugin runs. Use plugins.app:access scoped to plugins:id:grafana-assistant-app to control who can open Assistant. To remove or disable Assistant in a deployment, use the controls available in your stack. Where plugin settings expose enablement controls, an administrator can navigate to Administration > Plugins and data > Plugins, search for Grafana Assistant or go directly to /plugins/grafana-assistant-app, clear the agreement checkbox or the Assistant enabled or Enable Assistant checkbox, and click Save.

Understand available roles

Grafana offers baseline organization roles plus Assistant-specific roles. Combining them lets you tailor access without granting more privileges than necessary.

Organization roles define broad access in Grafana:

Assistant-specific roles extend or restrict access regardless of the user’s organization role:

Assign Assistant-specific roles to give targeted access to teammates who are not Editors or Admins.

Grant access in Grafana

Use the following procedures to grant the right level of access without over-provisioning.

Grant basic Assistant chat access

1. Sign in as an organization administrator.
2. Go to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant User.
5. Click Apply.

Grant CLI access

Users with the Editor organization role or above receive the Assistant CLI User role automatically. To grant CLI access to a user without the Editor role:

1. Sign in as an organization administrator.
2. Navigate to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant CLI User.
5. Click Apply.

Allow users to launch investigations and skills

1. Sign in as an organization administrator.
2. Navigate to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant Investigation User.
5. Click Apply.

Allow users to view system-created investigations

System-created investigations are launched automatically by IRM webhooks, alerts, or incidents. By default, only organization Admins can view them. This role is additive — the user also needs the Assistant Investigation User role for general investigation access.

1. Sign in as an organization administrator.
2. Navigate to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant Investigation User (if not already assigned).
5. Also choose Assistant > Assistant System Investigation Viewer.
6. Click Apply.

Delegate Assistant administration

1. Sign in as an organization administrator.
2. Navigate to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant Admin.
5. Click Apply.

Users can hold multiple Assistant roles if they need both investigation access and deployment-wide configuration control.

Control access to Investigations

Investigations use per-investigation visibility for normal access and an explicit tenant-wide permission for administration.

The Assistant Admin role includes grafana-assistant-app.investigations.all:read, which lets an administrator view every investigation in the stack, including another user’s private investigation and the chat that backs it. This permission grants read access only. It doesn’t let an administrator change an investigation’s team scope, pause or resume it, record hypothesis verdicts, or share it. Those actions still require the investigation’s creator or the appropriate role.

Control access to Automations

Automations use scoped permissions for normal access and explicit tenant-wide permissions for administration.

The Assistant Admin role includes both tenant-wide permissions and all scoped automation permissions. Tenant-wide read and write don’t expose another user’s private run history or grant permission to run or delete that user’s private automation. The UI labels these automations Private, shows their creator, and records the last editor when an administrator changes one.

Control access to Skills

Skills use separate permissions for personal and deployment-wide scope.

Users with Assistant User can create, edit, and delete their own Just me skills. Users with Assistant Admin can also create, edit, and delete Everybody skills for the deployment. Users who don’t have deployment-wide skill permissions can still view shared skills, but they can’t modify them.

Control access to Usage Analytics and limits

The Assistant > Usage page is gated by the grafana-assistant-app.usage:read permission. Editing limits from that page requires grafana-assistant-app.usage:write.

By default, these permissions are included in the Assistant Admin role. The Assistant Admin role is granted to the organization Admin basic role by default.

Enable Grafana Cloud MCP access

Grafana Cloud MCP access is automatically included for users with the Editor role or higher. To grant Grafana Cloud MCP access to users without the Editor role:

1. Sign in as an organization administrator.
2. Navigate to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant Cloud MCP User.
5. Click Apply.

To allow users to authorize write-scoped Grafana Cloud MCP connections (enabling tools that create or modify resources), add the Assistant Admin role.

For more information, refer to Grafana Cloud MCP server.

Enable MCP server management

To allow users to configure personal MCP servers without granting full Editor access:

1. Sign in as an organization administrator.
2. Navigate to Administration > Users and access > Users.
3. Select the user and open the Role picker.
4. Choose Assistant > Assistant MCP User.
5. Click Apply.

MCP servers configured with Everybody scope require deployment-wide MCP permissions, typically the Grafana Admin basic role or Assistant Admin.

Understand memory access control

Assistant respects Grafana’s existing RBAC when accessing memories:

• Dashboard memory: Search results are filtered based on your Grafana folder and dashboard permissions. You can only discover and reference dashboards you have access to view.
• Infrastructure memory: Semantic search results are filtered by datasource permissions. You can only access infrastructure metrics from datasources you’re authorized to query. If permissions can’t be verified, access is denied by default.

This ensures Assistant never exposes data beyond your existing Grafana permissions.

Map permissions to actions

Each Assistant role grants a set of permissions. Use the tables below when you need to understand or audit the underlying RBAC settings.

Core permissions

Actions and required permissions

Permissions with a * suffix mean the role needs read, create, write, and delete access for that feature area.

Next steps

• Review Manage your data privacy and security to understand data handling, third-party providers, security measures, and access controls.
• Review Pricing and limits to understand projected costs and limits.