--- title: "Security and access controls | Grafana Cloud documentation" description: "Understand tenant isolation, authentication, and RBAC roles in Agent Observability." --- > For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt). # Security and access controls Agent Observability enforces security at multiple layers: tenant isolation at the API level, authentication on SDK connections, and RBAC in Grafana Cloud. ## Before you begin - Enable Agent Observability on your Grafana Cloud stack. Refer to [Set up Agent Observability in Grafana Cloud](/docs/grafana-cloud/observe-and-act/agent-observability/get-started/grafana-cloud) ## Understand tenant isolation Every API request is scoped to a Grafana Cloud stack. Agent Observability enforces strict tenant boundaries. Generation data is scoped to the stack that exported it. Query APIs return only data for the authenticated stack. Evaluation rules and scores are stack-scoped. There is no cross-tenant data access. ## Authenticate SDK requests For generation ingest and experiment data in Grafana Cloud, SDKs use `basic` authentication with your instance ID and a Cloud Access Policy Token. Expand table | Field | Description | |---------------------------|-------------------------------------------------------------------------------------| | Instance ID | Numeric Grafana Cloud stack ID from the Agent Observability **Configuration** page. | | Cloud Access Policy Token | Token with the `sigil:write` scope. | Configuration changes require a Grafana user or service account with the required Agent Observability permissions. A Cloud Access Policy Token alone can’t authorize configuration changes. For API credential requirements, refer to [Choose API credentials](/docs/grafana-cloud/observe-and-act/agent-observability/reference/#choose-credentials). ## Configure RBAC Agent Observability defines five roles with increasing permissions. Assign roles through Grafana’s RBAC system to control who can view, annotate, and configure Agent Observability. Expand table | Role | Access | |-------------------------------------|------------------------------------------------------------------------------------------------------------------| | Agent Observability Viewer | Landing page and tutorial. | | Agent Observability Data Reader | Analytics, traces, model cards, agents, evaluation results, and experiments without conversation access. | | Agent Observability Reader | Conversations, analytics, traces, agents, model cards, evaluation results, and experiments. | | Agent Observability Feedback Writer | All Reader permissions plus feedback writing. | | Agent Observability Admin | Full access including creating and configuring evaluators, evaluation rules, guards, settings, and model prices. | Only the Agent Observability Admin role can create or modify evaluation rules, templates, experiments, guards, and model prices by default. To grant guards-only access, create a custom Grafana role with `grafana-agento11y-app.guards:write` (and the read permissions needed for evaluator testing). All roles with data access can view evaluation results and open the evaluation configure page in view-only mode (explore settings locally; changes are not saved). Persisting configuration, running configure playground previews/tests, and other eval write APIs require `grafana-agento11y-app.eval:write` (or guards write where documented). ## Map permissions to actions Each Agent Observability role grants a set of permissions. Use the table below when you need to understand or audit the underlying RBAC settings. Expand table | Permission | Description | Scope | |--------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------| | `plugins.app:access` | Access the Agent Observability plugin shell. | `plugins:id:grafana-agento11y-app` | | `grafana-agento11y-app.data:read` | View dashboards, traces, model cards, agents, evaluation results, and evaluation configure (view-only). | n/a | | `grafana-agento11y-app.conversations:read` | View conversations and request follow-ups. | n/a | | `grafana-agento11y-app.feedback:write` | Submit ratings and annotations on conversations. | n/a | | `grafana-agento11y-app.eval:write` | Create and manage evaluators, evaluation rules, templates, experiments, and test suites; run configure playground POST helpers (`POST /eval/rules:preview`, `POST /eval:test`, etc.). Previewing the rendered LLM-judge prompt (`POST /eval:render-prompt`) also requires `data:read` or `conversations:read`. | n/a | | `grafana-agento11y-app.guards:write` | Create and manage guards (hook rules) and their evaluators. Also grants evaluator write access so guard authors can create the evaluators their guards reference. Previewing the rendered LLM-judge prompt also requires `data:read` or `conversations:read`. | n/a | | `grafana-agento11y-app.settings:write` | Configure plugin datasource settings. | n/a | | `grafana-agento11y-app.pricing:write` | Set, list, and delete your own model prices. Refer to [Configure your model prices](/docs/grafana-cloud/observe-and-act/agent-observability/observe-and-troubleshoot/model-prices). | n/a | ## Next steps - [Set up Agent Observability in Grafana Cloud](/docs/grafana-cloud/observe-and-act/agent-observability/get-started/grafana-cloud) - [Review data handling and privacy](/docs/grafana-cloud/observe-and-act/agent-observability/privacy-and-access/privacy)