Documentation Grafana Cloud Platform Workflows Manage access

Manage access

The Workflows app uses Grafana role-based access control (RBAC) to control access to workflow definitions, run events, and secrets. Use this page to understand which role grants which capability and how to assign roles in Grafana Cloud.

Access to a workflow has three parts. A definition role decides whether a user can read or change workflow definitions. A Workflows plugin role decides which controls the user can use in the Workflows app. The folder that holds the workflow decides which workflows those roles apply to. A user needs all three.

What a user needs to read or edit workflows

Grafana grants the definition roles and the Workflows plugin roles to basic roles by default, so most users already hold the roles they need. Folder access is the part you usually manage per team.

Definition roles

Definition roles decide who can read and change workflow definitions. They apply in the Workflows app and in tools such as gcx, Terraform, and the API. Grafana grants each definition role to a basic role:

To let a user or service account create or change workflows, give them the Editor basic role. For everything a service account needs, refer to Give tools access.

Plugin roles

Plugin roles decide which controls a user can use in the Workflows app. They don’t grant access to workflow definitions, which the definition roles control.

The Workflows app has four plugin roles. Grafana assigns each role to one or more basic roles by default. An organization administrator can override the assignment for any user from the RBAC settings UI.

What each role grants

• Workflows Reader gives read-only use of the Workflows app. A user can browse workflows from Manage workflows and open a workflow in read-only mode, but can’t create, edit, run, or delete one. Which workflows they see depends on their definition role and folder access.
• Workflows Writer adds workflows:write, which turns on the app’s editing controls. A user can create new workflows, edit existing ones, click Run to trigger a workflow manually, and delete workflows. Changing a definition also requires a definition role and edit access to its folder.
• Events Reader lets a user see the Latest runs panel and inspect step inputs and outputs from completed runs.
• Events Writer can additionally trigger run events that drive the in-editor experience. You usually don’t need to grant this role manually, because the Editor and Admin basic roles already include it.

What you see when access is missing

If you don’t have the required permission, the Workflows app disables the affected control and shows a tooltip that explains why. The tooltips include:

• “You do not have permission to create a workflow”
• “You do not have permission to edit this workflow”
• “You do not have permission to execute this workflow”
• “You do not have permission to add steps to this workflow”

If you don’t have workflows:write, the Save, Run, Enable, and + controls in the editor are disabled.

Manage access with folders

Every workflow belongs to a Grafana folder. Folder permissions therefore decide which workflows a user can see and change, in the same way they decide which dashboards a user can see and change.

Use folders to separate workflows by team. For example, put the workflows your on-call team maintains in an On-call automation folder and grant that team edit access to it. Members of other teams keep their Workflows roles but see only the folders they have access to.

To set permissions on a folder:

1. In Grafana, navigate to Dashboards and open the folder.
2. Click Folder actions > Manage permissions.
3. Add a user, team, or basic role and choose View, Edit, or Admin.

For more information about folder permissions, refer to Manage dashboard permissions.

To choose or change the folder for a workflow, refer to Place a workflow in a folder.

Manage access in Grafana Cloud

To assign a Workflows role to a user or team:

1. In Grafana, navigate to Administration > Users and access > Users (or Teams).
2. Select the user or team you want to update.
3. In the Permissions section, add or remove Workflows Reader, Workflows Writer, Events Reader, or Events Writer as needed.

You can also assign these roles through the Grafana Cloud RBAC API.

Manage access to secrets

The Workflows Secrets page uses Grafana Secrets Management permissions, which are separate from the Workflows plugin roles:

To manage secrets from the Secrets page, a user needs these permissions in addition to a Workflows role. For details on how Workflows uses these secrets, refer to Manage secrets.

How Ask Assistant steps use your permissions

An Ask Assistant step calls the Grafana Assistant on behalf of a person, not a generic service account. Workflows uses the permissions of whoever last saved the workflow for a scheduled or event-triggered run, and the permissions of whoever clicks Run for a manual run. An Ask Assistant step can only do what that person is allowed to do in your Grafana Cloud stack.

Workflows never falls back to a shared service identity for this. If Workflows can’t identify the right person for a run, the Ask Assistant step fails. This means an Ask Assistant step can behave differently, or fail, depending on who last saved or ran the workflow. If a step fails with a permission error for one person but not another, check what the assistant needs access to and confirm that person has the required Grafana Cloud permissions.

Next steps

• Manage secrets
• Create workflows
• Observe workflow runs
• Troubleshoot workflows