---
title: "Application Observability role-based access control | Grafana Cloud documentation"
description: "Learn about RBAC roles supported in Application observability"
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Application Observability role-based access control

Application Observability supports role-based access control (RBAC). RBAC provides a standardized way of granting, changing, and revoking access when it comes to viewing and modifying Grafana resources, such as dashboards, reports, and administrative settings.

> Note
> 
> Application Observability RBAC only includes a set of basic roles and not fine-grained access. See which roles are defined below.

Refer to the [Grafana RBAC documentation](/docs/grafana/latest/administration/roles-and-permissions/access-control/) to learn more about RBAC in Grafana Cloud.

## Available Application Observability RBAC roles

If you grant a user any of the following roles, that user will also be granted the `plugins.app:access` action with a scope of `plugins:id:grafana-app-observability-app`. This action grants the user the ability to access the plugin.

Expand table

| Role   | Description                                                             | Granted to           |
|--------|-------------------------------------------------------------------------|----------------------|
| Admin  | Read/write access to everything in the Application Observability plugin | Grafana Admin, Admin |
| Viewer | View access in Application Observability plugin                         | Editor, Viewer       |

## Other roles used in Application Observability

Application Observability also requires the following roles.

### Data sources > Reader

This role is required to read any data from the data sources used by Application Observability.

### Data sources > Explorer

This role is required to show the Open in Explore buttons available throughout Application Observability.

### Annotations > Reader

This role is required to show annotations in the service overview RED panels.

### Plugins > Plugin Writer

This role is required by the Application Observability Admin role to persist changes on the configuration page.