Security and access controls

Agent Observability enforces security at multiple layers: tenant isolation at the API level, authentication on SDK connections, and RBAC in Grafana Cloud.

Understand tenant isolation

Every API request is scoped to a Grafana Cloud stack. Agent Observability enforces strict tenant boundaries. Generation data is scoped to the stack that exported it. Query APIs return only data for the authenticated stack. Evaluation rules and scores are stack-scoped. There is no cross-tenant data access.

Authenticate SDK requests

For Grafana Cloud, SDKs use basic authentication with your instance ID and a Cloud Access Policy Token.

Field	Description
Instance ID	Numeric Grafana Cloud stack ID from the Agent Observability Configuration page.
Cloud Access Policy Token	Token with the `sigil:write` scope.

Configure RBAC

Agent Observability defines five roles with increasing permissions. Assign roles through Grafana’s RBAC system to control who can view, annotate, and configure Agent Observability.

Role	Access
Agent Observability Viewer	Landing page and tutorial.
Agent Observability Data Reader	Analytics, traces, model cards, agents, evaluation results, and experiments without conversation access.
Agent Observability Reader	Conversations, analytics, traces, agents, model cards, evaluation results, and experiments.
Agent Observability Feedback Writer	All Reader permissions plus feedback writing.
Agent Observability Admin	Full access including creating and configuring evaluators, evaluation rules, guards, and settings.

Only the Agent Observability Admin role can create or modify evaluators, evaluation rules, guards, and experiments. All other roles with data access can view evaluation results but cannot change evaluation or guard configuration.