Security and access controls

Agent Observability enforces security at multiple layers: tenant isolation at the API level, authentication on SDK connections, and RBAC in Grafana Cloud.

Before you begin

Enable Agent Observability on your Grafana Cloud stack. Refer to Set up Agent Observability in Grafana Cloud

Understand tenant isolation

Every API request is scoped to a Grafana Cloud stack. Agent Observability enforces strict tenant boundaries. Generation data is scoped to the stack that exported it. Query APIs return only data for the authenticated stack. Evaluation rules and scores are stack-scoped. There is no cross-tenant data access.

Authenticate SDK requests

For generation ingest and experiment data in Grafana Cloud, SDKs use basic authentication with your instance ID and a Cloud Access Policy Token.

Field	Description
Instance ID	Numeric Grafana Cloud stack ID from the Agent Observability Configuration page.
Cloud Access Policy Token	Token with the `sigil:write` scope.

Configuration changes require a Grafana user or service account with the required Agent Observability permissions. A Cloud Access Policy Token alone can’t authorize configuration changes. For API credential requirements, refer to Choose API credentials.

Configure RBAC

Agent Observability defines five roles with increasing permissions. Assign roles through Grafana’s RBAC system to control who can view, annotate, and configure Agent Observability.

Role	Access
Agent Observability Viewer	Landing page and tutorial.
Agent Observability Data Reader	Analytics, traces, model cards, agents, evaluation results, and experiments without conversation access.
Agent Observability Reader	Conversations, analytics, traces, agents, model cards, evaluation results, and experiments.
Agent Observability Feedback Writer	All Reader permissions plus feedback writing.
Agent Observability Admin	Full access including creating and configuring evaluators, evaluation rules, guards, settings, and model prices.

Only the Agent Observability Admin role can create or modify evaluation rules, templates, experiments, guards, and model prices by default. To grant guards-only access, create a custom Grafana role with grafana-agento11y-app.guards:write (and the read permissions needed for evaluator testing). All roles with data access can view evaluation results and open the evaluation configure page in view-only mode (explore settings locally; changes are not saved). Persisting configuration, running configure playground previews/tests, and other eval write APIs require grafana-agento11y-app.eval:write (or guards write where documented).

Map permissions to actions

Each Agent Observability role grants a set of permissions. Use the table below when you need to understand or audit the underlying RBAC settings.

Permission	Description	Scope
`plugins.app:access`	Access the Agent Observability plugin shell.	`plugins:id:grafana-agento11y-app`
`grafana-agento11y-app.data:read`	View dashboards, traces, model cards, agents, evaluation results, and evaluation configure (view-only).	n/a
`grafana-agento11y-app.conversations:read`	View conversations and request follow-ups.	n/a
`grafana-agento11y-app.feedback:write`	Submit ratings and annotations on conversations.	n/a
`grafana-agento11y-app.eval:write`	Create and manage evaluators, evaluation rules, templates, experiments, and test suites; run configure playground POST helpers (`POST /eval/rules:preview`, `POST /eval:test`, etc.). Previewing the rendered LLM-judge prompt (`POST /eval:render-prompt`) also requires `data:read` or `conversations:read`.	n/a
`grafana-agento11y-app.guards:write`	Create and manage guards (hook rules) and their evaluators. Also grants evaluator write access so guard authors can create the evaluators their guards reference. Previewing the rendered LLM-judge prompt also requires `data:read` or `conversations:read`.	n/a
`grafana-agento11y-app.settings:write`	Configure plugin datasource settings.	n/a
`grafana-agento11y-app.pricing:write`	Set, list, and delete your own model prices. Refer to Configure your model prices.	n/a