--- title: "Manage Assistant access with RBAC | Grafana Cloud documentation" description: "Understand how to assign Grafana Assistant roles and permissions." --- > For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt). # Manage Assistant access with RBAC Grafana Assistant relies on Grafana role-based access control (RBAC) so you can decide who can chat, run investigations, or administer deployment-wide settings. This article explains the roles available, the permissions they unlock, and how to grant users the access they need. > Note > > Grafana Cloud honors the permissions granted by basic, custom, and Assistant-specific roles. In self-managed Grafana, use the basic **Viewer**, **Editor**, and **Admin** organization roles unless you run Grafana Enterprise in a configuration that supports Assistant custom permissions. In other self-managed deployments, Assistant uses a compatibility fallback based on the user’s basic organization role: Viewers can access and read, Editors can also create, write, and delete non-administrative resources, and Admins receive administrative permissions. Custom and Assistant-specific roles can’t grant permissions beyond this fallback. Contact your Grafana account team to confirm whether your deployment supports Assistant custom permissions. The `plugins.app:access` permission still controls access to the plugin, and self-managed deployments hide some Grafana Cloud-dependent features entirely. ## Before you begin Decide who needs chat access, admin access, or investigation access before you start assigning roles. - **Organization administrator access**: Only admins can assign Assistant-related roles and permissions. - **RBAC plan**: Decide which teams need chat, investigations, or administrative control. For planning guidance, refer to [Plan your Grafana RBAC rollout strategy](/docs/grafana/latest/administration/roles-and-permissions/access-control/plan-rbac-rollout-strategy/). - **Feature availability**: Confirm Assistant is available or enabled in your stack. Investigations require a separate entitlement. - **Scope per deployment**: Assistant uses Grafana RBAC in the Grafana deployment where the plugin runs. In self-managed Grafana Enterprise deployments that support Assistant custom permissions, permissions are resolved by that local Grafana instance, even when it isn’t reachable from the internet. Use `plugins.app:access` scoped to `plugins:id:grafana-assistant-app` to control who can open Assistant. To remove or disable Assistant in a deployment, use the controls available in your stack. Where plugin settings expose enablement controls, an administrator can navigate to **Administration** > **Plugins and data** > **Plugins**, search for **Grafana Assistant** or go directly to `/plugins/grafana-assistant-app`, clear the agreement checkbox or the **Assistant enabled** or **Enable Assistant** checkbox, and click **Save**. ## Understand available roles Grafana offers baseline organization roles plus Assistant-specific roles. Combining them lets you tailor access without granting more privileges than necessary. **Organization roles** define broad access in Grafana: Expand table | Organization role | What the role can do with Grafana Assistant | |-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Admin | Full access to Assistant chat, investigations, rules, and MCP server management. | | Editor | Chat, coding execution, CLI access, investigations, personal MCP server management, and read-only cloud agent and GitHub App settings. | | Viewer | Chat, coding execution, and read-only cloud agent and repository settings. | | No basic role | No Assistant access. In Grafana Cloud or in self-managed Grafana Enterprise deployments that support Assistant custom permissions, an administrator can add an Assistant-specific role instead. | > Tip > > To limit Assistant access for users who hold a Viewer or Editor organization role, an administrator can [update the basic role with the RBAC API](/docs/grafana/latest/administration/roles-and-permissions/access-control/manage-rbac-roles/#update-basic-role-using-the-rbac-api) and remove specific permissions. For example, remove `plugins.app:access` scoped to `plugins:id:grafana-assistant-app` or remove `grafana-assistant-app.chats:access` from the Viewer role. **Assistant-specific roles** extend or restrict access regardless of the user’s organization role in Grafana Cloud. They also work in self-managed Grafana Enterprise deployments that support Assistant custom permissions: Expand table | Assistant role | What the role unlocks | |-----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Assistant Coding User | Runs cloud agents and reads safe provider and repository settings. Granted to Viewer, Editor, and Admin by default. | | Assistant Coding Maintainer | Configures authorized repositories, including environments, reviews, mentions, and automatic PRs. Manages shared sandbox secrets. Explicit assignment only. | | Assistant Coding Admin | Administers global coding policy and integrations as well as repositories. Granted to Admin by default. | | Assistant Admin | Administers deployment-wide Assistant settings, usage analytics and limits, rules, MCP servers, automations, and investigations in addition to chat. | | Assistant Sandbox Admin | Manages Python sandbox settings. Granted to Admin by default. | | Assistant Cloud MCP User | Authorizes and manages external AI agent connections to Grafana via the [Grafana Cloud MCP server](/docs/grafana-cloud/ai-tools/mcp-servers/cloud-mcp/). | | Assistant MCP User | Uses Assistant chat, manages personal MCP servers and rules, and views cloud agent and GitHub App settings. | | Assistant User | Basic Assistant chat, read-only cloud agent settings, personal rule management, personal skills, personal automations, and Assistant Watchers. | | Assistant CLI User | Authenticates and uses the Grafana Assistant CLI. Grants `grafana-assistant-app.tokens:access`. Automatically assigned to users with the **Editor** organization role or above. | | Assistant Investigation User | Launches and manages Assistant investigations. | | Assistant Infrastructure Memory Scanner | Starts an infrastructure memory scan, which regenerates the stack’s infrastructure memories. Granted to Editor and Admin by default. | | Assistant System Investigation Viewer | Adds visibility of system-created investigations. Combine with **Assistant Investigation User** or organization Admin. | | gcx User | Authorizes GCX CLI connections to Grafana. Granted to the Viewer role by default so any logged-in user can run `gcx login`. | Assign Assistant-specific roles to give targeted access to teammates who are not Editors or Admins in Grafana Cloud or in self-managed Grafana Enterprise deployments that support Assistant custom permissions. > Note > > System-created investigations (launched automatically via IRM webhooks, alerts, or incidents) are hidden by default. Only users with the **Assistant System Investigation Viewer** role (combined with **Assistant Investigation User**) or organization **Admin** role can see them. ## View sandbox secret metadata When sandbox secrets are enabled, Viewers can see each secret’s name, description, environment variable, type, and destination. Settings never show saved secret values. Viewing personal secrets requires `grafana-assistant-app.sandbox-secrets.user:read`, and viewing shared secrets requires `grafana-assistant-app.sandbox-secrets.tenant:read`. Assistant Coding User, Assistant Coding Maintainer, and Assistant Coding Admin include both. For custom roles, grant the read action for each scope they need. No settings permission is required. Read access doesn’t let anyone change or decrypt secrets. To manage secrets, refer to [Sandbox secret permissions](#sandbox-secret-permissions). ## Grant access in Grafana Use the following procedures to grant the right level of access without over-provisioning. If you use self-managed Grafana without support for Assistant custom permissions, grant Assistant access with the basic **Viewer**, **Editor**, or **Admin** organization roles and `plugins.app:access`. The Assistant-specific role procedures in this section apply to Grafana Cloud and to self-managed Grafana Enterprise deployments that support Assistant custom permissions. ### Grant basic Assistant chat access 1. Sign in as an organization administrator. 2. Go to **Administration > Users and access > Users**. 3. Select the user and open the **Role** picker. 4. Choose **Assistant > Assistant User**. 5. Click **Apply**. ### Grant CLI access Users with the **Editor** organization role or above receive the **Assistant CLI User** role automatically. To grant CLI access to a user without the Editor role: 1. Sign in as an organization administrator. 2. Navigate to **Administration > Users and access > Users**. 3. Select the user and open the **Role** picker. 4. Choose **Assistant > Assistant CLI User**. 5. Click **Apply**. ### Allow users to launch investigations and skills 1. Sign in as an organization administrator. 2. Navigate to **Administration > Users and access > Users**. 3. Select the user and open the **Role** picker. 4. Choose **Assistant > Assistant Investigation User**. 5. Click **Apply**. ### Allow users to view system-created investigations System-created investigations are launched automatically by IRM webhooks, alerts, or incidents. By default, only organization Admins can view them. This role is additive — the user also needs the **Assistant Investigation User** role for general investigation access. 1. Sign in as an organization administrator. 2. Navigate to **Administration > Users and access > Users**. 3. Select the user and open the **Role** picker. 4. Choose **Assistant > Assistant Investigation User** (if not already assigned). 5. Also choose **Assistant > Assistant System Investigation Viewer**. 6. Click **Apply**. ### View cloud agent settings By default, Viewers, Editors, and Admins can read cloud agent settings. **Assistant User** and **Assistant MCP User** include `grafana-assistant-app.settings.coding-agents:read`, so you can see the configured providers and defaults without admin access. This permission doesn’t expose credentials or grant access to the GitHub, Cursor, or Claude integration settings. To enable or disable cloud agents, choose the provider, or set the approval policy, you need `grafana-assistant-app.settings.coding-agents:write`, included in **Assistant Coding Admin** and **Assistant Admin**. Sandbox secrets use separate permissions. Refer to [Sandbox secret permissions](#sandbox-secret-permissions). ### Control cloud agent access **Assistant Coding User** is granted to Viewer, Editor, and Admin by default. It lets users run cloud agents and read coding configuration other than credentials. Cloud agents must also be enabled for the tenant, and repository and user authorization still apply. Coding Users can see every repository the tenant’s GitHub App installation can access, including private repository names, and each repository’s enrollment, network, and automatic-publication settings. This extends GitHub settings visibility to Viewers. It doesn’t grant access to repository contents or bypass authorization when cloud agents run. Refreshing the repository inventory cache requires **Assistant Coding Maintainer** or **Assistant Coding Admin**. Viewing environment build logs requires **Assistant Coding Admin**, or **Assistant Coding Maintainer** with GitHub write access to the repository. `grafana-assistant-app.github:read` alone permits neither. Assign **Assistant Coding Maintainer** explicitly to users or teams who manage repositories. With their linked GitHub account’s current write access, Maintainers can configure repository enrollment, environments, network policy, reviews, mentions, and automatic pull requests. They can also manage shared sandbox secrets. Refer to [Sandbox secret permissions](#sandbox-secret-permissions). They can’t connect GitHub installations, change global coding policy, turn on mentions globally, or allow change review and mentions on public repositories. **Assistant Coding Admin**, granted to Admin by default, also manages global coding settings and integrations. No coding role grants access to another user’s private conversations or credentials. Connecting a GitHub App installation verifies ownership with the connecting user’s linked GitHub account. Users with `grafana-assistant-app.github:write` can link their own GitHub account without `grafana-assistant-app.chats:access`, so **Connect GitHub** works for Coding Admins who can’t use Assistant chat. The same permission lets them unlink their account. To restrict coding while preserving chat, remove `grafana-assistant-app.coding:execute` from the relevant basic-role permissions and assign Coding User to the intended users or teams. Grafana permissions are additive: removing one assignment does not revoke a permission still granted by another role or team. Refer to [Manage RBAC roles](/docs/grafana/latest/administration/roles-and-permissions/access-control/manage-rbac-roles/). Fine-grained delegation requires Grafana Cloud or Grafana Enterprise RBAC. Without it, self-managed Grafana lets Viewer, Editor, and Admin run cloud agents and reserves repository configuration for Admin. Disabling coding blocks new work and follow-ups, including queued starts. It doesn’t cancel work that has already started. Settings show global editing controls only to users with the required permissions. ### Delegate Assistant administration 1. Sign in as an organization administrator. 2. Navigate to **Administration > Users and access > Users**. 3. Select the user and open the **Role** picker. 4. Choose **Assistant > Assistant Admin**. 5. Click **Apply**. Users can hold multiple Assistant roles if they need both investigation access and deployment-wide configuration control. ### Control access to Investigations Investigations use per-investigation visibility for normal access and an explicit tenant-wide permission for administration. Expand table | Permission | Access | |----------------------------------------------------|-----------------------------------------------------------------------------------------------------| | `grafana-assistant-app.investigations:read` | View investigations you can access: your own and ones scoped to your Grafana teams. | | `grafana-assistant-app.investigations:create` | Launch investigations. | | `grafana-assistant-app.investigations.system:read` | View system-created investigations from IRM webhooks, alerts, and incidents. | | `grafana-assistant-app.investigations.all:read` | View every investigation in the stack, including another user’s private investigation and its chat. | The **Assistant Admin** role includes `grafana-assistant-app.investigations.all:read`, which lets an administrator view every investigation in the stack, including another user’s private investigation and the chat that backs it. This permission grants read access only. It doesn’t let an administrator change an investigation’s team scope, pause or resume it, record hypothesis verdicts, or share it. Those actions still require the investigation’s creator or the appropriate role. ### Control access to Automations Automations use scoped permissions for normal access and explicit tenant-wide permissions for administration. Expand table | Permission | Access | |---------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `grafana-assistant-app.automations.user:read` | View personal automations owned by the caller. | | `grafana-assistant-app.automations.user:create` | Create and manually run personal automations owned by the caller. | | `grafana-assistant-app.automations.user:write` | Edit, enable, and disable personal automations owned by the caller. | | `grafana-assistant-app.automations.user:delete` | Delete personal automations owned by the caller. | | `grafana-assistant-app.automations.tenant:read` | View automations shared with everybody in the stack. | | `grafana-assistant-app.automations.tenant:create` | Create and manually run automations shared with everybody in the stack. | | `grafana-assistant-app.automations.tenant:write` | Edit, enable, and disable automations shared with everybody in the stack. | | `grafana-assistant-app.automations.tenant:delete` | Delete automations shared with everybody in the stack. | | `grafana-assistant-app.automations:read` | View every automation in the stack, including another user’s private automation. | | `grafana-assistant-app.automations:write` | Edit automations across owners and visibility scopes, including their enabled state. Service-account automations also require the Grafana organization Admin role. | The **Assistant Admin** role includes both tenant-wide permissions and all scoped automation permissions. Creating or editing an automation that runs as the Assistant service account also requires the **Grafana organization Admin** role; **Assistant Admin** alone is insufficient. Such an automation must use **Everybody** visibility. Every invocation uses the existing Assistant tenant service account and the organization’s system-initiated token pool. Tenant-wide read and write don’t expose another user’s private run history or grant permission to run or delete that user’s private automation. The UI labels these automations **Private**, shows their creator, and records the last editor when an administrator changes one. ### Control access to Skills Skills use separate permissions for personal and deployment-wide scope. Expand table | Permission | Access | |----------------------------------------------|---------------------------------------------------------| | `grafana-assistant-app.skills.user:read` | View **Just me** skills owned by the caller. | | `grafana-assistant-app.skills.user:create` | Create **Just me** skills owned by the caller. | | `grafana-assistant-app.skills.user:write` | Edit **Just me** skills owned by the caller. | | `grafana-assistant-app.skills.user:delete` | Delete **Just me** skills owned by the caller. | | `grafana-assistant-app.skills.tenant:read` | View **Everybody** skills shared with the deployment. | | `grafana-assistant-app.skills.tenant:create` | Create **Everybody** skills shared with the deployment. | | `grafana-assistant-app.skills.tenant:write` | Edit **Everybody** skills shared with the deployment. | | `grafana-assistant-app.skills.tenant:delete` | Delete **Everybody** skills shared with the deployment. | Users with **Assistant User** can create, edit, and delete their own **Just me** skills. Users with **Assistant Admin** can also create, edit, and delete **Everybody** skills for the deployment. Users who don’t have deployment-wide skill permissions can still view shared skills, but they can’t modify them. ### Control access to Usage Analytics and limits The **Assistant > Usage** page is gated by the `grafana-assistant-app.usage:read` permission. Editing limits from that page requires `grafana-assistant-app.usage:write`. By default, these permissions are included in the **Assistant Admin** role. The **Assistant Admin** role is granted to the organization **Admin** basic role by default. ### Enable Grafana Cloud MCP access Grafana Cloud MCP access is automatically included for users with the **Editor** role or higher. To grant Grafana Cloud MCP access to users without the Editor role: 1. Sign in as an organization administrator. 2. Navigate to **Administration > Users and access > Users**. 3. Select the user and open the **Role** picker. 4. Choose **Assistant > Assistant Cloud MCP User**. 5. Click **Apply**. Grafana Cloud MCP connections come in three levels of access, and a user can only authorize a level they hold the permission for: Expand table | Connection access | Permission | Included in | |-------------------|-------------------------------------------------|------------------------------| | Read | `grafana-assistant-app.cloud-mcp:access` | **Assistant Cloud MCP User** | | Query | `grafana-assistant-app.cloud-mcp.query:execute` | **Assistant Cloud MCP User** | | Write | `grafana-assistant-app.cloud-mcp.scope:write` | **Assistant Admin** | Query access lets a connection run queries against SQL data sources, for example, ClickHouse, Snowflake, Athena, and InfluxDB. These queries run as written, so a connection with query access can change data when the data source credentials allow it. Read access on its own doesn’t include these tools. To allow users to authorize write-scoped Grafana Cloud MCP connections, which enable tools that create or modify resources, add the **Assistant Admin** role. Write access includes query access. When an MCP client asks for access, the authorization page lists each level as a separate checkbox. Users can clear any level they don’t want to grant, and levels they can’t authorize appear unavailable. For more information, refer to [Grafana Cloud MCP server](/docs/grafana-cloud/ai-tools/mcp-servers/cloud-mcp/). ### Enable MCP server management To allow users to configure personal MCP servers without granting full Editor access: 1. Sign in as an organization administrator. 2. Navigate to **Administration > Users and access > Users**. 3. Select the user and open the **Role** picker. 4. Choose **Assistant > Assistant MCP User**. 5. Click **Apply**. MCP servers configured with **Everybody** scope require deployment-wide MCP permissions, typically the Grafana **Admin** basic role or **Assistant Admin**. Configuring a personal or shared MCP server to use PDC also requires `grafana-assistant-app.mcps.pdc:write`. This permission is included in **Assistant Admin** by default. The permission is required for all updates to existing MCP servers that use PDC. ### Sandbox secret permissions When sandbox secrets are enabled, creating, editing, or deleting a secret requires a verified human identity and the Assistant action for that operation. Assistant stores new secret values itself, so they don’t need Grafana Secrets Manager permissions. Existing standalone Secrets Manager records still need the matching Secrets Manager permissions, which coding roles don’t grant: Expand table | Scope | Actions | Resources | |-------------------|-------------------------------------------------------------------------------------|------------------------------------| | Personal | `grafana-assistant-app.sandbox-secrets.user:read`, `:create`, `:write`, `:delete` | Secrets owned by the current user | | Organization-wide | `grafana-assistant-app.sandbox-secrets.tenant:read`, `:create`, `:write`, `:delete` | Shared secrets in the organization | Assistant Coding User includes both read actions and the personal create, write, and delete actions. Assistant Coding Maintainer and Assistant Coding Admin include all eight actions. None of these actions require global coding-settings write. No role gives access to another user’s personal secrets through Assistant. Changing a secret’s owner scope requires write access to both scopes. Secret grants moved from Assistant User, Assistant MCP User, and Assistant Admin to the coding roles. Default basic-role assignments keep access. If you assigned one of those general roles explicitly, or a custom role that managed secrets through coding-settings write, add a coding role or the secret actions. Repository selection limits which sandbox runs receive a secret. It doesn’t grant repository access. Authorized runs use matching secrets without management permissions. Runs without a user identity receive only shared secrets. ## Understand memory access control Assistant respects Grafana’s existing RBAC when accessing memories: - **Dashboard memory**: Search results are filtered based on your Grafana folder and dashboard permissions. You can only discover and reference dashboards you have access to view. - **Infrastructure memory**: Semantic search results are filtered by datasource permissions. You can only access infrastructure metrics from datasources you’re authorized to query. If permissions can’t be verified, access is denied by default. This ensures Assistant never exposes data beyond your existing Grafana permissions. ## Map permissions to actions Each Assistant role grants a set of permissions. Use the tables below when you need to understand or audit the underlying RBAC settings. **Core permissions** Expand table | Permission | Description | Scope | |-------------------------------------------------------|---------------------------------------------------------------------------------------------------------------|------------------------------------| | `plugins.app:access` | Access the Assistant plugin shell. | `plugins:id:grafana-assistant-app` | | `grafana-assistant-app.settings.terms:write` | Manage Assistant enablement and terms settings. | n/a | | `grafana-assistant-app.settings.sql-discovery:read` | Read SQL table discovery settings. | n/a | | `grafana-assistant-app.settings.sql-discovery:write` | Configure SQL table discovery settings. | n/a | | `grafana-assistant-app.settings.analyst:read` | Read Analyst mode data warehouse settings. | n/a | | `grafana-assistant-app.settings.analyst:write` | Configure the Analyst mode data warehouse datasource. | n/a | | `grafana-assistant-app.settings.investigations:read` | Read tenant investigation settings, including alert continuation. | n/a | | `grafana-assistant-app.settings.investigations:write` | Configure tenant investigation settings, including skipped incident labels and alert continuation. | n/a | | `grafana-assistant-app.settings.infra-memory:read` | List the data sources an infrastructure memory scan can read. | n/a | | `grafana-assistant-app.settings.infra-memory:write` | Configure infrastructure memory, including which data sources it scans. | n/a | | `grafana-assistant-app.infra-memory.scans:create` | Start an infrastructure memory scan, which replaces existing infrastructure memories when it completes. | n/a | | `grafana-assistant-app.settings.chat-retention:read` | View chat retention settings. | n/a | | `grafana-assistant-app.settings.chat-retention:write` | Configure the chat retention policy. | n/a | | `grafana-assistant-app.chats:access` | Use Assistant chat. | n/a | | `grafana-assistant-app.tokens:access` | Authenticate with the Grafana Assistant CLI. | n/a | | `grafana-assistant-app.rules.user:read` | Read personal Assistant rules. | n/a | | `grafana-assistant-app.rules.user:create` | Create personal Assistant rules. | n/a | | `grafana-assistant-app.rules.user:write` | Update personal Assistant rules. | n/a | | `grafana-assistant-app.rules.user:delete` | Delete personal Assistant rules. | n/a | | `grafana-assistant-app.rules.tenant:read` | Read tenant-level Assistant rules. | n/a | | `grafana-assistant-app.rules.tenant:create` | Create tenant-level Assistant rules. | n/a | | `grafana-assistant-app.rules.tenant:write` | Update tenant-level Assistant rules. | n/a | | `grafana-assistant-app.rules.tenant:delete` | Delete tenant-level Assistant rules. | n/a | | `grafana-assistant-app.mcps.user:read` | Read personal MCP servers. | n/a | | `grafana-assistant-app.mcps.user:create` | Create personal MCP servers. | n/a | | `grafana-assistant-app.mcps.user:write` | Update personal MCP servers. | n/a | | `grafana-assistant-app.mcps.user:delete` | Delete personal MCP servers. | n/a | | `grafana-assistant-app.mcps.tenant:read` | Read tenant MCP servers. | n/a | | `grafana-assistant-app.mcps.tenant:create` | Create tenant MCP servers. | n/a | | `grafana-assistant-app.mcps.tenant:write` | Update tenant MCP servers. | n/a | | `grafana-assistant-app.mcps.tenant:delete` | Delete tenant MCP servers. | n/a | | `grafana-assistant-app.mcps.pdc:write` | Configure personal or shared MCP servers that use PDC. | n/a | | `grafana-assistant-app.coding:execute` | Run cloud agents and public repository discovery; independent of chat access. | n/a | | `grafana-assistant-app.coding.repositories:write` | Configure repositories and refresh their environments, with current GitHub write access. | n/a | | `grafana-assistant-app.github:read` | Read GitHub App connection and repository access settings. | n/a | | `grafana-assistant-app.github:write` | Configure GitHub App connection and repository access settings, and link or unlink a personal GitHub account. | n/a | | `grafana-assistant-app.settings.coding-agents:read` | Read cloud agent settings, such as enablement, provider, and approval policy. | n/a | | `grafana-assistant-app.settings.coding-agents:write` | Enable or disable cloud agents, choose the provider, and set the approval policy. | n/a | | `grafana-assistant-app.cursor:read` | Read whether a Cursor API key is configured. The key isn’t returned. | n/a | | `grafana-assistant-app.cursor:write` | Store, replace, clear, or validate the Cursor API key. | n/a | | `grafana-assistant-app.claude:read` | Read whether an Anthropic API key is configured for Claude Managed Agents. The key isn’t returned. | n/a | | `grafana-assistant-app.claude:write` | Store, replace, clear, or validate the Anthropic API key for Claude Managed Agents. | n/a | | `grafana-assistant-app.sandbox:write` | View and change Python sandbox settings. | n/a | | `grafana-assistant-app.investigations:read` | View investigations. | n/a | | `grafana-assistant-app.investigations:create` | Launch investigations. | n/a | | `grafana-assistant-app.investigations.system:read` | View system-created investigations. | n/a | | `grafana-assistant-app.investigations.all:read` | View every investigation in the stack, including private investigations and their chats. | n/a | | `grafana-assistant-app.cloud-mcp:access` | Connect external AI agents via Grafana Cloud MCP and manage connections. | n/a | | `grafana-assistant-app.cloud-mcp.query:execute` | Authorize Grafana Cloud MCP connections with query scope. | n/a | | `grafana-assistant-app.cloud-mcp.scope:write` | Authorize Grafana Cloud MCP connections with write scope. | n/a | | `grafana-assistant-app.skills.user:read` | Read personal skills. | n/a | | `grafana-assistant-app.skills.user:create` | Create personal skills. | n/a | | `grafana-assistant-app.skills.user:write` | Update personal skills. | n/a | | `grafana-assistant-app.skills.user:delete` | Delete personal skills. | n/a | | `grafana-assistant-app.skills.tenant:read` | Read deployment-wide shared skills. | n/a | | `grafana-assistant-app.skills.tenant:create` | Create deployment-wide shared skills. | n/a | | `grafana-assistant-app.skills.tenant:write` | Update deployment-wide shared skills. | n/a | | `grafana-assistant-app.skills.tenant:delete` | Delete deployment-wide shared skills. | n/a | | `grafana-assistant-app.automations.user:read` | View personal automations owned by the caller. | n/a | | `grafana-assistant-app.automations.user:create` | Create or manually run personal automations owned by the caller. | n/a | | `grafana-assistant-app.automations.user:write` | Edit, enable, or disable personal automations owned by the caller. | n/a | | `grafana-assistant-app.automations.user:delete` | Delete personal automations owned by the caller. | n/a | | `grafana-assistant-app.automations.tenant:read` | View automations shared with everybody in the stack. | n/a | | `grafana-assistant-app.automations.tenant:create` | Create or manually run automations shared with everybody in the stack. | n/a | | `grafana-assistant-app.automations.tenant:write` | Edit, enable, or disable automations shared with everybody in the stack. | n/a | | `grafana-assistant-app.automations.tenant:delete` | Delete automations shared with everybody in the stack. | n/a | | `grafana-assistant-app.automations:read` | View every automation in the stack, including private automations. | n/a | | `grafana-assistant-app.automations:write` | Update every automation in the stack, including private automations. | n/a | | `grafana-assistant-app.usage:read` | View Usage Analytics for the deployment. | n/a | | `grafana-assistant-app.usage:write` | Update deployment usage limits. | n/a | | `grafana-assistant-app.tokens.gcx:access` | Authorize a GCX CLI connection to Grafana (`gcx login`). Granted to Viewer by default. | n/a | | `grafana-assistant-app.watcher-agents:read` | View Assistant Watchers. | n/a | | `grafana-assistant-app.watcher-agents:create` | Create Assistant Watchers and run an existing Watcher immediately. | n/a | | `grafana-assistant-app.watcher-agents:write` | Update, calibrate, start, and pause Assistant Watchers. | n/a | | `grafana-assistant-app.watcher-agents:delete` | Delete Assistant Watchers. | n/a | **Actions and required permissions** Expand table | Assistant action | Required permissions (all) | |------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------| | Enable Assistant or manage terms | `grafana-assistant-app.settings.terms:write`, `plugins.app:access` | | Configure SQL table discovery | `grafana-assistant-app.settings.sql-discovery:write`, `grafana-assistant-app.settings.sql-discovery:read`, `plugins.app:access` | | Configure Analyst data warehouse | `grafana-assistant-app.settings.analyst:write`, `grafana-assistant-app.settings.analyst:read`, `plugins.app:access` | | Configure investigation settings | `grafana-assistant-app.settings.investigations:write`, `grafana-assistant-app.settings.investigations:read`, `plugins.app:access` | | Configure infrastructure memory | `grafana-assistant-app.settings.infra-memory:write`, `grafana-assistant-app.settings.infra-memory:read`, `plugins.app:access` | | Start an infrastructure memory scan | `grafana-assistant-app.infra-memory.scans:create`, `plugins.app:access` | | Configure chat retention | `grafana-assistant-app.settings.chat-retention:write`, `grafana-assistant-app.settings.chat-retention:read`, `plugins.app:access` | | Use Assistant chat | `grafana-assistant-app.chats:access`, `plugins.app:access` | | Authenticate with the CLI | `grafana-assistant-app.tokens:access`, `plugins.app:access` | | Manage personal rules | `grafana-assistant-app.rules.user:*`, `grafana-assistant-app.chats:access`, `plugins.app:access` | | Manage personal MCP servers | `grafana-assistant-app.mcps.user:*`, `grafana-assistant-app.chats:access`, `plugins.app:access` | | Manage tenant rules | `grafana-assistant-app.rules.tenant:*`, `grafana-assistant-app.chats:access`, `plugins.app:access` | | Manage tenant MCP servers | `grafana-assistant-app.mcps.tenant:*`, `grafana-assistant-app.chats:access`, `plugins.app:access` | | View GitHub App access | `grafana-assistant-app.github:read`, `plugins.app:access` | | Configure GitHub App access | `grafana-assistant-app.github:write`, `grafana-assistant-app.github:read`, `plugins.app:access` | | View cloud agent settings | `grafana-assistant-app.settings.coding-agents:read`, `plugins.app:access` | | Configure cloud agent settings | `grafana-assistant-app.settings.coding-agents:write`, `plugins.app:access` | | Configure the Cursor API key | `grafana-assistant-app.cursor:write`, `plugins.app:access` | | List Cursor models | `grafana-assistant-app.settings.coding-agents:write`, `grafana-assistant-app.cursor:read`, `plugins.app:access` | | Configure the Anthropic API key | `grafana-assistant-app.claude:write`, `plugins.app:access` | | List Claude models | `grafana-assistant-app.settings.coding-agents:write`, `grafana-assistant-app.claude:read`, `plugins.app:access` | | Manage Python sandbox settings | `grafana-assistant-app.sandbox:write`, `plugins.app:access` | | Use investigations | `grafana-assistant-app.investigations:read`, `grafana-assistant-app.investigations:create`, `grafana-assistant-app.chats:access`, `plugins.app:access` | | View system-created investigations | `grafana-assistant-app.investigations.system:read`, `grafana-assistant-app.investigations:read`, `plugins.app:access` | | View every investigation | `grafana-assistant-app.investigations.all:read`, `grafana-assistant-app.investigations:read`, `plugins.app:access` | | Manage personal skills | `grafana-assistant-app.skills.user:*`, `grafana-assistant-app.chats:access`, `plugins.app:access` | | Manage tenant-wide skills | `grafana-assistant-app.skills.tenant:*`, `grafana-assistant-app.chats:access`, `plugins.app:access` | | View personal automations | `grafana-assistant-app.automations.user:read`, `plugins.app:access` | | Create or manually run personal automations | `grafana-assistant-app.automations.user:create`, `plugins.app:access` | | Edit, enable, or disable personal automations | `grafana-assistant-app.automations.user:write`, `plugins.app:access` | | Delete personal automations | `grafana-assistant-app.automations.user:delete`, `plugins.app:access` | | View automations shared with everybody | `grafana-assistant-app.automations.tenant:read`, `plugins.app:access` | | Create or manually run shared automations | `grafana-assistant-app.automations.tenant:create`, `plugins.app:access` | | Edit, enable, or disable shared automations | `grafana-assistant-app.automations.tenant:write`, `plugins.app:access` | | Delete automations shared with everybody | `grafana-assistant-app.automations.tenant:delete`, `plugins.app:access` | | View and edit every automation | `grafana-assistant-app.automations:read`, `grafana-assistant-app.automations:write`, `plugins.app:access` | | Manage Assistant Watchers | `grafana-assistant-app.watcher-agents:*`, `plugins.app:access` | | View Watcher usage limits | `grafana-assistant-app.watcher-agents:read`, `plugins.app:access` | | View Usage Analytics dashboard | `grafana-assistant-app.usage:read`, `plugins.app:access` | | Configure usage limits | `grafana-assistant-app.usage:write`, `grafana-assistant-app.usage:read`, `plugins.app:access` | | Connect via Grafana Cloud MCP | `grafana-assistant-app.cloud-mcp:access`, `plugins.app:access` | | Authorize query-scoped Grafana Cloud MCP connections | `grafana-assistant-app.cloud-mcp.query:execute`, `grafana-assistant-app.cloud-mcp:access`, `plugins.app:access` | | Authorize write-scoped Grafana Cloud MCP connections | `grafana-assistant-app.cloud-mcp.scope:write`, `grafana-assistant-app.cloud-mcp:access`, `plugins.app:access` | | Authorize a GCX CLI connection (`gcx login`) | `grafana-assistant-app.tokens.gcx:access`, `plugins.app:access` | Permissions with a `*` suffix mean the role needs read, create, write, and delete access for that feature area. ## Next steps - Review [Manage your data privacy and security](/docs/grafana-cloud/platform/grafana-assistant/privacy-and-security) to understand data handling, third-party providers, security measures, and access controls. - Review [Pricing and limits](/docs/grafana-cloud/platform/grafana-assistant/pricing) to understand projected costs and limits.