Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.
A permission is an action and a scope. When creating a fine-grained access control, consider what specific action a user should be allowed to perform, and on what resources (its scope).
To grant permissions to a user, you create a built-in role assignment to map a role to a built-in role. A built-in role assignment modifies to one of the existing built-in roles in Grafana (Viewer, Editor, Admin). For more information, refer to Built-in role assignments.
The specific action on a resource defines what a user is allowed to perform if they have permission with the relevant action assigned to it.
scope
The scope describes where an action can be performed, such as reading a specific user profile. In such case, a permission is associated with the scope users:<userId> to the relevant role.
Action definitions
The following list contains fine-grained access control actions.
Action
Applicable scope
Description
roles:list
roles:*
List available roles without permissions.
roles:read
roles:*
Read a specific role with its permissions.
roles:write
permissions:delegate
Create or update a custom role.
roles:delete
permissions:delegate
Delete a custom role.
roles.builtin:list
roles:*
List built-in role assignments.
roles.builtin:add
permissions:delegate
Create a built-in role assignment.
roles.builtin:remove
permissions:delegate
Delete a built-in role assignment.
reports.admin:create
reports:*
Create reports.
reports.admin:write
reports:*
Update reports.
reports:delete
reports:*
Delete reports.
reports:read
reports:*
List all available reports or get a specific report.
reports:send
reports:*
Send a report email.
reports.settings:write
n/a
Update report settings.
reports.settings:read
n/a
Read report settings.
provisioning:reload
provisioners:*
Reload provisioning files. To find the exact scope for specific provisioner, see Scope definitions.
users:read
global:users:*
Read or search user profiles.
users:write
global:users:*
Update a user’s profile.
users.teams:read
global:users:*
Read a user’s teams.
users.authtoken:list
global:users:*
List authentication tokens that are assigned to a user.
users.authtoken:update
global:users:*
Update authentication tokens that are assigned to a user.
users.password:update
global:users:*
Update a user’s password.
users:delete
global:users:*
Delete a user.
users:create
n/a
Create a user.
users:enable
global:users:*
Enable a user.
users:disable
global:users:*
Disable a user.
users.permissions:update
global:users:*
Update a user’s organization-level permissions.
users:logout
global:users:*
Sign out a user.
users.quotas:list
global:users:*
List a user’s quotas.
users.quotas:update
global:users:*
Update a user’s quotas.
org.users:read
users:*
Get user profiles within an organization.
org.users:add
users:*
Add a user to an organization.
org.users:remove
users:*
Remove a user from an organization.
org.users.role:update
users:*
Update the organization role (Viewer, Editor, or Admin) of an organization.
ldap.user:read
n/a
Get a user via LDAP.
ldap.user:sync
n/a
Sync a user via LDAP.
ldap.status:read
n/a
Verify the availability of the LDAP server or servers.
The following list contains fine-grained access control scopes.
Scopes
Descriptions
roles:*
Restrict an action to a set of roles. For example, roles:* matches any role, roles:randomuid matches only the role with UID randomuid and roles:custom:reports:{editor,viewer} matches both custom:reports:editor and custom:reports:viewer roles.
permissions:delegate
The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment.
reports:*
Restrict an action to a set of reports. For example, reports:* matches any report and reports:1 matches the report with id 1.
services:accesscontrol
Restrict an action to target only the fine-grained access control service. You can use this in conjunction with the status:accesscontrol actions.
global:users:*
Restrict an action to a set of global users.
users:*
Restrict an action to a set of users from an organization.
settings:*
Restrict an action to a subset of settings. For example, settings:* matches all settings, settings:auth.saml:* matches all SAML settings, and settings:auth.saml:enabled matches the enable property on the SAML settings.
provisioners:*
Restrict an action to a set of provisioners. For example, provisioners:* matches any provisioner, and provisioners:accesscontrol matches the fine-grained access control provisioner.
Restrict an action to a set of data sources. For example, datasources:* matches any data source, and datasources:name:postgres matches the data source named postgres.
