Grafana Cloud
Observe and act
Monitor applications
Frontend Observability
Session replay
Role-based access control (RBAC)Session Replay role-based access control
Note
Session Replay is currently in private preview. Grafana Labs offers support on a best-effort basis, and breaking changes might occur prior to the feature being made generally available.
Session recordings capture how end users interact with your application. Even with the default masking in Session Replay, recordings can still reflect application state and user behavior that not everyone in your organization needs to see. Use role-based access control (RBAC) to restrict who can view recordings, without changing who can access the rest of Frontend Observability.
Session Replay RBAC is layered on top of the Frontend Observability roles. Users must have access to Frontend Observability to see any session data, and must also hold the Session Replay role to view recordings.
Refer to the Grafana RBAC documentation to learn more about how RBAC works in Grafana Cloud.
Available Session Replay RBAC roles
Granting the following role also grants the user the plugins.app:access action with a scope of plugins:id:grafana-sessionreplay-app, which lets the user access the Session Replay plugin.
By default, the Recordings Viewer role is granted to the basic Viewer role. Because Editor and Admin inherit from Viewer, users with any of those basic roles can view recordings out of the box. To restrict access, remove Recordings Viewer from the basic Viewer role. This also removes it from Editor and Admin. Then assign it explicitly to the users, teams, or service accounts that should have it. Refer to Assign the Recordings Viewer role.
How Session Replay RBAC interacts with Frontend Observability roles
Session Replay RBAC only controls who can view recordings. All other Frontend Observability data, including session lists, errors, traces, logs, and metrics, remains governed by Frontend Observability roles.
- A user without the
Recordings Viewerrole can still use every non-replay part of Frontend Observability. They see the sessions list, filters, errors, traces, and logs as usual, but replay controls and links are hidden. - A user with the
Recordings Viewerrole but no Frontend Observability access can’t reach recordings, because they can’t reach the sessions that contain the replay UI.
Session Replay RBAC also doesn’t affect data collection. Whether Session Replay records data is controlled by the feo11ySessionReplay feature toggle at the stack level and by the presence of ReplayInstrumentation in your Faro Web SDK configuration, not by RBAC.
Access surfaces gated by the Recordings Viewer role
When a user doesn’t have the Recordings Viewer role, the following controls and links are hidden or blocked:
- Sessions table: The Session replay column is hidden.
- Errors summary: The inline replay player is hidden, and the Replays available jump link doesn’t appear.
- Error instances table: The Replay column and per-row replay buttons are hidden.
- Session details page: The inline replay widget is hidden.
- Full-screen replay viewer: The bottom-navigation entry and any View replay links are hidden.
- Direct URLs to recordings: Requests to the Session Replay plugin proxy are blocked server-side with a
403 Forbiddenresponse, so bookmarked or shared replay URLs don’t grant access.
Users without the role don’t see an error message on replay pages. Grafana removes controls and links rather than disabling them, so the pages appear the same as they would for a stack without Session Replay enabled.
Assign the Recordings Viewer role
Assign Recordings Viewer through the existing Grafana role-assignment flows. You can assign it to individual users, teams, or service accounts.
For a step-by-step walkthrough of assignment options, including the UI, API, and file-based provisioning, refer to Assign RBAC roles.
Restrict replay access to specific users or teams
By default, every user with the basic Viewer role or higher has the Recordings Viewer role. To restrict recording access to a subset of users, such as your customer support team:
- Remove
Recordings Viewerfrom the basicViewerrole so it’s no longer granted by default. BecauseEditorandAdmininherit fromViewer, they also lose the role at this step. Refer to Manage RBAC roles for how to update basic role permissions. - Assign
Recordings Viewerdirectly to the users, teams, or service accounts that should be able to view recordings.
Frequently asked questions
Can you grant replay access by team or department?
Yes. You can assign the Recordings Viewer role to a Grafana team, and every member of the team inherits it. For assignment options, refer to Assign RBAC roles.
Does the Recordings Viewer role grant access to other Frontend Observability data?
No. Recordings Viewer only controls access to session recordings. Access to sessions, errors, traces, logs, and metrics is governed separately by Frontend Observability roles.
What happens to existing users when Session Replay RBAC is enabled?
Nothing changes by default. Recordings Viewer is granted to the basic Viewer role, so users with Viewer, Editor, or Admin continue to see recordings as before. Existing users only lose access if you explicitly remove Recordings Viewer from a basic role and don’t reassign it to them.
Can you grant replay access per session or per application?
No. Recordings Viewer is a stack-wide role: a user with the role can view every recording in the stack, and a user without it can view none. Finer-grained access, such as per app, per environment, or per session, isn’t currently supported.
Does the role block direct URL access to recordings, or only the UI?
Both. The UI hides replay controls and links for users without the role, and the Session Replay plugin proxy also enforces the grafana-sessionreplay-app.recordings:read action server-side, so bookmarked or shared URLs return 403 Forbidden for users without the role.
