---
title: "Manage access | Grafana Cloud documentation"
description: "Grant Grafana Workflows access to your team using the plugin's RBAC roles and folder permissions for workflow definitions, run events, and secrets."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Manage access

> Note
> 
> Grafana Workflows is currently in [public preview](/docs/release-life-cycle/). Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.

The Workflows app uses Grafana role-based access control (RBAC) to control access to workflow definitions, run events, and secrets. Use this page to understand which role grants which capability and how to assign roles in Grafana Cloud.

Access to a workflow has three parts. A definition role decides whether a user can read or change workflow definitions. A Workflows plugin role decides which controls the user can use in the Workflows app. The folder that holds the workflow decides which workflows those roles apply to. A user needs all three.

## What a user needs to read or edit workflows

Expand table

| Task                               | Roles and permissions                   | Folder access                        |
|------------------------------------|-----------------------------------------|--------------------------------------|
| View a workflow and its definition | Viewer basic role                       | View access to the workflow’s folder |
| Create, edit, or delete            | Editor basic role and `workflows:write` | Edit access to the workflow’s folder |
| Run                                | Workflows Writer                        | Edit access to the workflow’s folder |
| Inspect run history and step data  | Events Reader                           | View access to the workflow’s folder |

Grafana grants the definition roles and the Workflows plugin roles to basic roles by default, so most users already hold the roles they need. Folder access is the part you usually manage per team.

## Definition roles

Definition roles decide who can read and change workflow definitions. They apply in the Workflows app and in tools such as gcx, Terraform, and the API. Grafana grants each definition role to a basic role:

Expand table

| Role             | Description                                            | Default basic role assignment |
|------------------|--------------------------------------------------------|-------------------------------|
| workflows Reader | Read workflow definitions.                             | Viewer                        |
| workflows Editor | Create, read, update, and delete workflow definitions. | Editor                        |
| workflows Admin  | Take any action on workflow definitions.               | Admin                         |

To let a user or service account create or change workflows, give them the Editor basic role. For everything a service account needs, refer to [Give tools access](/docs/grafana-cloud/platform/workflows/as-code/#give-tools-access).

## Plugin roles

Plugin roles decide which controls a user can use in the Workflows app. They don’t grant access to workflow definitions, which the definition roles control.

The Workflows app has four plugin roles. Grafana assigns each role to one or more basic roles by default. An organization administrator can override the assignment for any user from the RBAC settings UI.

Expand table

| Role             | Description                              | Default basic role assignment | Permission actions                                      |
|------------------|------------------------------------------|-------------------------------|---------------------------------------------------------|
| Workflows Reader | Use the Workflows app in read-only mode. | Viewer                        | `grafana-workflows-app.workflows:read`                  |
| Workflows Writer | Create, edit, run, and delete workflows. | Editor, Admin                 | `grafana-workflows-app.workflows:read`, `:write`        |
| Events Reader    | Read workflow run events.                | Viewer, Editor, Admin         | `grafana-workflows-app.workflows-events:read`           |
| Events Writer    | Create and manage workflow run events.   | Editor, Admin                 | `grafana-workflows-app.workflows-events:read`, `:write` |

### What each role grants

- **Workflows Reader** gives read-only use of the Workflows app. A user can browse workflows from **Manage workflows** and open a workflow in read-only mode, but can’t create, edit, run, or delete one. Which workflows they see depends on their definition role and folder access.
- **Workflows Writer** adds `workflows:write`, which turns on the app’s editing controls. A user can create new workflows, edit existing ones, click **Run** to trigger a workflow manually, and delete workflows. Changing a definition also requires a definition role and edit access to its folder.
- **Events Reader** lets a user see the **Latest runs** panel and inspect step inputs and outputs from completed runs.
- **Events Writer** can additionally trigger run events that drive the in-editor experience. You usually don’t need to grant this role manually, because the Editor and Admin basic roles already include it.

## What you see when access is missing

If you don’t have the required permission, the Workflows app disables the affected control and shows a tooltip that explains why. The tooltips include:

- “You do not have permission to create a workflow”
- “You do not have permission to edit this workflow”
- “You do not have permission to execute this workflow”
- “You do not have permission to add steps to this workflow”

If you don’t have `workflows:write`, the **Save**, **Run**, **Enable**, and **+** controls in the editor are disabled.

## Manage access with folders

Every workflow belongs to a Grafana folder. Folder permissions therefore decide which workflows a user can see and change, in the same way they decide which dashboards a user can see and change.

Use folders to separate workflows by team. For example, put the workflows your on-call team maintains in an **On-call automation** folder and grant that team edit access to it. Members of other teams keep their Workflows roles but see only the folders they have access to.

To set permissions on a folder:

1. In Grafana, navigate to **Dashboards** and open the folder.
2. Click **Folder actions** > **Manage permissions**.
3. Add a user, team, or basic role and choose **View**, **Edit**, or **Admin**.

For more information about folder permissions, refer to [Manage dashboard permissions](/docs/grafana/latest/administration/user-management/manage-dashboard-permissions/).

To choose or change the folder for a workflow, refer to [Place a workflow in a folder](/docs/grafana-cloud/platform/workflows/create-workflows/#place-a-workflow-in-a-folder).

## Manage access in Grafana Cloud

To assign a Workflows role to a user or team:

1. In Grafana, navigate to **Administration** > **Users and access** > **Users** (or **Teams**).
2. Select the user or team you want to update.
3. In the **Permissions** section, add or remove **Workflows Reader**, **Workflows Writer**, **Events Reader**, or **Events Writer** as needed.

You can also assign these roles through the [Grafana Cloud RBAC API](/docs/grafana-cloud/account-management/authentication-and-permissions/access-control/).

## Manage access to secrets

The Workflows **Secrets** page uses Grafana Secrets Management permissions, which are separate from the Workflows plugin roles:

Expand table

| Capability      | Permission action            |
|-----------------|------------------------------|
| List secrets    | `secret.securevalues:read`   |
| Create a secret | `secret.securevalues:create` |
| Update a secret | `secret.securevalues:write`  |
| Delete a secret | `secret.securevalues:delete` |

To manage secrets from the **Secrets** page, a user needs these permissions in addition to a Workflows role. For details on how Workflows uses these secrets, refer to [Manage secrets](/docs/grafana-cloud/platform/workflows/manage-secrets).

## How Ask Assistant steps use your permissions

An [Ask Assistant](/docs/grafana-cloud/platform/workflows/reference/#ask-assistant-assistantprompt) step calls the Grafana Assistant on behalf of a person, not a generic service account. Workflows uses the permissions of whoever last saved the workflow for a scheduled or event-triggered run, and the permissions of whoever clicks **Run** for a manual run. An Ask Assistant step can only do what that person is allowed to do in your Grafana Cloud stack.

Workflows never falls back to a shared service identity for this. If Workflows can’t identify the right person for a run, the Ask Assistant step fails. This means an Ask Assistant step can behave differently, or fail, depending on who last saved or ran the workflow. If a step fails with a permission error for one person but not another, check what the assistant needs access to and confirm that person has the required Grafana Cloud permissions.

## Next steps

- [Manage secrets](/docs/grafana-cloud/platform/workflows/manage-secrets)
- [Create workflows](/docs/grafana-cloud/platform/workflows/create-workflows)
- [Observe workflow runs](/docs/grafana-cloud/platform/workflows/observe-runs)
- [Troubleshoot workflows](/docs/grafana-cloud/platform/workflows/troubleshoot)