--- title: "Session Replay role-based access control | Grafana Cloud documentation" description: "Learn how to use role-based access control (RBAC) to gate access to Session Replay recordings and how the Session Replay role interacts with Frontend Observability roles" --- > For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt). # Session Replay role-based access control > Note > > Session Replay is currently in [private preview](/docs/release-life-cycle/). Grafana Labs offers support on a best-effort basis, and breaking changes might occur prior to the feature being made generally available. Session recordings capture how end users interact with your application. Even with the default masking in Session Replay, recordings can still reflect application state and user behavior that not everyone in your organization needs to see. Use role-based access control (RBAC) to restrict who can view recordings, without changing who can access the rest of Frontend Observability. Session Replay RBAC is layered on top of the [Frontend Observability roles](/docs/grafana-cloud/monitor-applications/frontend-observability/settings-and-policies/rbac/). Users must have access to Frontend Observability to see any session data, and must also hold the Session Replay role to view recordings. Refer to the [Grafana RBAC documentation](/docs/grafana/latest/administration/roles-and-permissions/access-control/) to learn more about how RBAC works in Grafana Cloud. ## Available Session Replay RBAC roles Granting the following role also grants the user the `plugins.app:access` action with a scope of `plugins:id:grafana-sessionreplay-app`, which lets the user access the Session Replay plugin. Expand table | Role | Description | Granted actions | Basic roles granted to | |-------------------|-----------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------|------------------------| | Recordings Viewer | View session recordings in Frontend Observability, including the inline replay widget, the full-screen replay viewer, and direct links. | `grafana-sessionreplay-app.recordings:read` | Viewer | By default, the `Recordings Viewer` role is granted to the basic `Viewer` role. Because `Editor` and `Admin` inherit from `Viewer`, users with any of those basic roles can view recordings out of the box. To restrict access, remove `Recordings Viewer` from the basic `Viewer` role. This also removes it from `Editor` and `Admin`. Then assign it explicitly to the users, teams, or service accounts that should have it. Refer to [Assign the Recordings Viewer role](#assign-the-recordings-viewer-role). ## How Session Replay RBAC interacts with Frontend Observability roles Session Replay RBAC only controls who can view recordings. All other Frontend Observability data, including session lists, errors, traces, logs, and metrics, remains governed by Frontend Observability roles. - A user without the `Recordings Viewer` role can still use every non-replay part of Frontend Observability. They see the sessions list, filters, errors, traces, and logs as usual, but replay controls and links are hidden. - A user with the `Recordings Viewer` role but no Frontend Observability access can’t reach recordings, because they can’t reach the sessions that contain the replay UI. Session Replay RBAC also doesn’t affect data collection. Whether Session Replay records data is controlled by the [`feo11ySessionReplay` feature toggle at the stack level](/docs/grafana-cloud/monitor-applications/frontend-observability/session-replay/) and by the presence of `ReplayInstrumentation` in your [Faro Web SDK configuration](/docs/grafana-cloud/monitor-applications/frontend-observability/session-replay/instrument/), not by RBAC. ## Access surfaces gated by the Recordings Viewer role When a user doesn’t have the `Recordings Viewer` role, the following controls and links are hidden or blocked: - **Sessions table**: The **Session replay** column is hidden. - **Errors summary**: The inline replay player is hidden, and the **Replays available** jump link doesn’t appear. - **Error instances table**: The **Replay** column and per-row replay buttons are hidden. - **Session details page**: The inline replay widget is hidden. - **Full-screen replay viewer**: The bottom-navigation entry and any **View replay** links are hidden. - **Direct URLs to recordings**: Requests to the Session Replay plugin proxy are blocked server-side with a `403 Forbidden` response, so bookmarked or shared replay URLs don’t grant access. Users without the role don’t see an error message on replay pages. Grafana removes controls and links rather than disabling them, so the pages appear the same as they would for a stack without Session Replay enabled. ## Assign the Recordings Viewer role Assign `Recordings Viewer` through the existing Grafana role-assignment flows. You can assign it to individual users, teams, or service accounts. For a step-by-step walkthrough of assignment options, including the UI, API, and file-based provisioning, refer to [Assign RBAC roles](/docs/grafana/latest/administration/roles-and-permissions/access-control/assign-rbac-roles/). ### Restrict replay access to specific users or teams By default, every user with the basic `Viewer` role or higher has the `Recordings Viewer` role. To restrict recording access to a subset of users, such as your customer support team: 1. Remove `Recordings Viewer` from the basic `Viewer` role so it’s no longer granted by default. Because `Editor` and `Admin` inherit from `Viewer`, they also lose the role at this step. Refer to [Manage RBAC roles](/docs/grafana/latest/administration/roles-and-permissions/access-control/manage-rbac-roles/#update-role-permissions) for how to update basic role permissions. 2. Assign `Recordings Viewer` directly to the users, teams, or service accounts that should be able to view recordings. ## Frequently asked questions ### Can you grant replay access by team or department? Yes. You can assign the `Recordings Viewer` role to a Grafana team, and every member of the team inherits it. For assignment options, refer to [Assign RBAC roles](/docs/grafana/latest/administration/roles-and-permissions/access-control/assign-rbac-roles/). ### Does the Recordings Viewer role grant access to other Frontend Observability data? No. `Recordings Viewer` only controls access to session recordings. Access to sessions, errors, traces, logs, and metrics is governed separately by [Frontend Observability roles](/docs/grafana-cloud/monitor-applications/frontend-observability/settings-and-policies/rbac/). ### What happens to existing users when Session Replay RBAC is enabled? Nothing changes by default. `Recordings Viewer` is granted to the basic `Viewer` role, so users with `Viewer`, `Editor`, or `Admin` continue to see recordings as before. Existing users only lose access if you explicitly remove `Recordings Viewer` from a basic role and don’t reassign it to them. ### Can you grant replay access per session or per application? No. `Recordings Viewer` is a stack-wide role: a user with the role can view every recording in the stack, and a user without it can view none. Finer-grained access, such as per app, per environment, or per session, isn’t currently supported. ### Does the role block direct URL access to recordings, or only the UI? Both. The UI hides replay controls and links for users without the role, and the Session Replay plugin proxy also enforces the `grafana-sessionreplay-app.recordings:read` action server-side, so bookmarked or shared URLs return `403 Forbidden` for users without the role.