---
title: "Security and access controls | Grafana Cloud documentation"
description: "Understand tenant isolation, authentication, and RBAC roles in Agent Observability."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Security and access controls

Agent Observability enforces security at multiple layers: tenant isolation at the API level, authentication on SDK connections, and RBAC in Grafana Cloud.

## Understand tenant isolation

Every API request is scoped to a Grafana Cloud stack. Agent Observability enforces strict tenant boundaries. Generation data is scoped to the stack that exported it. Query APIs return only data for the authenticated stack. Evaluation rules and scores are stack-scoped. There is no cross-tenant data access.

## Authenticate SDK requests

For Grafana Cloud, SDKs use `basic` authentication with your instance ID and a Cloud Access Policy Token.

Expand table

| Field                     | Description                                                                         |
|---------------------------|-------------------------------------------------------------------------------------|
| Instance ID               | Numeric Grafana Cloud stack ID from the Agent Observability **Configuration** page. |
| Cloud Access Policy Token | Token with the `sigil:write` scope.                                                 |

## Configure RBAC

Agent Observability defines five roles with increasing permissions. Assign roles through Grafana’s RBAC system to control who can view, annotate, and configure Agent Observability.

Expand table

| Role                                | Access                                                                                                   |
|-------------------------------------|----------------------------------------------------------------------------------------------------------|
| Agent Observability Viewer          | Landing page and tutorial.                                                                               |
| Agent Observability Data Reader     | Analytics, traces, model cards, agents, evaluation results, and experiments without conversation access. |
| Agent Observability Reader          | Conversations, analytics, traces, agents, model cards, evaluation results, and experiments.              |
| Agent Observability Feedback Writer | All Reader permissions plus feedback writing.                                                            |
| Agent Observability Admin           | Full access including creating and configuring evaluators, evaluation rules, guards, and settings.       |

Only the Agent Observability Admin role can create or modify evaluators, evaluation rules, guards, and experiments. All other roles with data access can view evaluation results but cannot change evaluation or guard configuration.

## Next steps

- [Data handling and privacy](/docs/grafana-cloud/observe-and-act/agent-observability/privacy-and-security/privacy)
- [Use Agent Observability on Grafana Cloud](/docs/grafana-cloud/observe-and-act/agent-observability/get-started/grafana-cloud)