Documentationbreadcrumb arrow Grafana Cloudbreadcrumb arrow Observe and actbreadcrumb arrow Monitor applicationsbreadcrumb arrow Session Replaybreadcrumb arrow Role-based access control (RBAC)
Public preview Grafana Cloud

Session Replay role-based access control

Note

Session Replay is currently in public preview. Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.

Session recordings capture how end users interact with your application. Even with the default masking in Session Replay, recordings can still reflect application state and user behavior that not everyone in your organization needs to see. Use role-based access control (RBAC) to restrict who can view recordings, without changing who can access the rest of Frontend Observability.

Session Replay RBAC is layered on top of the Frontend Observability roles. Users must have access to Frontend Observability to see any session data, and must also hold the Session Replay role to view recordings.

Refer to the Grafana RBAC documentation to learn more about how RBAC works in Grafana Cloud.

Available Session Replay RBAC roles

Granting the following role also grants the user the plugins.app:access action with a scope of plugins:id:grafana-sessionreplay-app, which lets the user access the Session Replay plugin.

RoleDescriptionGranted actionsBasic roles granted to
Recordings ViewerView session recordings in Frontend Observability, including the inline replay widget, the full-screen replay viewer, and direct links.grafana-sessionreplay-app.recordings:readViewer

By default, users with a basic Viewer, Editor, Admin, or Grafana Admin role can view recordings.

Note

Each basic role holds this permission independently. Removing Recordings Viewer from Viewer doesn’t automatically remove it from Editor, Admin, or Grafana Admin. To fully revoke default access, edit each basic role separately. Refer to Restrict replay access to specific users or teams.

How Session Replay RBAC interacts with Frontend Observability roles

Session Replay RBAC only controls who can view recordings. All other Frontend Observability data, including session lists, errors, traces, logs, and metrics, remains governed by Frontend Observability roles.

  • A user without the Recordings Viewer role can still use every non-replay part of Frontend Observability. They see the sessions list, filters, errors, traces, and logs as usual, but replay controls and links are hidden.
  • A user with the Recordings Viewer role but no Frontend Observability access can’t reach recordings, because they can’t reach the sessions that contain the replay UI.

Session Replay RBAC also doesn’t affect data collection. Whether Session Replay records data is controlled by the feo11ySessionReplay feature toggle at the stack level and by the presence of ReplayInstrumentation in your Faro Web SDK configuration, not by RBAC.

Access surfaces gated by the Recordings Viewer role

When a user doesn’t have the Recordings Viewer role, the following controls and links are hidden or blocked:

  • Sessions table: The Session replay column is hidden.
  • Errors summary: The inline replay player is hidden, and the Replays available jump link doesn’t appear.
  • Error instances table: The Replay column and per-row replay buttons are hidden.
  • Session details page: The inline replay widget is hidden.
  • Full-screen replay viewer: The bottom-navigation entry and any View replay links are hidden.
  • Direct URLs to recordings: Requests to the Session Replay plugin proxy are blocked server-side with a 403 Forbidden response, so bookmarked or shared replay URLs don’t grant access.

Users without the role don’t see an error message on replay pages. Grafana removes controls and links rather than disabling them, so the pages appear the same as they would for a stack without Session Replay enabled.

Assign the Recordings Viewer role

Assign Recordings Viewer through the existing Grafana role-assignment flows. You can assign it to individual users, teams, or service accounts.

For a step-by-step walkthrough of assignment options, including the UI, API, and file-based provisioning, refer to Assign RBAC roles.

Restrict replay access to specific users or teams

To restrict recording access to a subset of users, such as your customer support team:

  1. Remove Recordings Viewer from the Viewer, Editor, Admin, and Grafana Admin basic roles. Refer to Update role permissions.
  2. Assign Recordings Viewer directly to the users, teams, or service accounts that should be able to view recordings.

Frequently asked questions

Can you grant replay access by team or department?

Yes. You can assign the Recordings Viewer role to a Grafana team, and every member of the team inherits it. For assignment options, refer to Assign RBAC roles.

Does the Recordings Viewer role grant access to other Frontend Observability data?

No. Recordings Viewer only controls access to session recordings. Access to sessions, errors, traces, logs, and metrics is governed separately by Frontend Observability roles.

What happens to existing users when Session Replay RBAC is enabled?

Nothing changes by default. Users with Viewer, Editor, Admin, or Grafana Admin continue to see recordings as before.

Can you grant replay access per session or per application?

No. Recordings Viewer is a stack-wide role: a user with the role can view every recording in the stack, and a user without it can view none. Finer-grained access, such as per app, per environment, or per session, isn’t currently supported.

Does the role block direct URL access to recordings, or only the UI?

Both. The UI hides replay controls and links for users without the role, and the Session Replay plugin proxy also enforces the grafana-sessionreplay-app.recordings:read action server-side, so bookmarked or shared URLs return 403 Forbidden for users without the role.