User access prerequisites
The service authenticates through ClickHouse Cloud. Users must belong to your ClickHouse Cloud organization and have access to the Observability service. See Manage cloud users for organization membership. The Cloud SQL Console access levels map to Observability access as follows:
Open Team Settings → Members & Roles to view team members and their current Observability roles. Select Manage in Console to manage organization membership in ClickHouse Cloud.
Built-in roles
The service includes three system roles. You can’t edit or delete these. The Admin role is assigned to the team creator by default.Assigning roles to team members
The Members & Roles tab in Team Settings lists team members with their current role. To change a role, click Edit next to the user’s name and select a new role. Each user has exactly one role.Default new user role
Under Team Settings → Members & Roles, use Default New User Role below the roles list to choose the role assigned to users who auto-join the team. If no default is set, new users receive the Member role.Creating a custom role
2
Add a new role
Click + Add Role. Enter a Role Name and optionally add a Description.
3
Configure permissions and save
Set permissions for the role, then click Create Role.
Role permissions
Resource permissions
Each role grants an access level per resource type. The three levels are:
The resource types you can control are:
- Dashboards — saved dashboard layouts and charts.
- Saved searches — persisted log/trace/event queries.
- Sources — data sources used to query observability data.
- Alerts — alert rules and their notification settings.
- Webhooks — outbound notification destinations (such as Slack, PagerDuty, and generic HTTP endpoints) that alerts deliver to. This doesn’t refer to the observability API.
- Notebooks — collaborative investigation notebooks.
Administrative permissions
In addition to resource permissions, each role includes two administrative settings:- Users (No Access · Read) — controls whether the role can view team members and their roles. Manage organization membership through Manage in Console.
- Team (Read · Manage) — controls whether the role can view or modify team-level settings such as security policies and RBAC configuration.
Fine-grained access rules
Dashboards, Saved Searches, Sources, and Notebooks support fine-grained controls that restrict access to individual resources within a category. Use these when you need to limit a role to specific resources rather than granting blanket access to the entire resource type.Default access vs. fine-grained controls
Each resource type has an Access Control Mode:- Default Access — applies a single access level (No Access, Read, or Manage) to all resources of that type.
- Fine-Grained Controls — lets you define access rules that match specific resources by condition. Resources that don’t match any rule default to no access.
Configuring access rules
Each access rule consists of a condition and an access level. Conditions match resources by their properties:
The following screenshot shows both the dashboard ID highlighted in the URL bar and a “TESTING” tag visible in the tag panel (top-right).
You can add multiple rules per resource type. Each rule is checked independently using OR logic — a resource is accessible if it matches any rule. Resources that don’t match any rule aren’t accessible.
Example: To give a role read-only access to testing dashboards, expand Dashboards, switch to Fine-Grained Controls, and add two rules:
- Name
containstestingwith access level Read - Tag
istestingwith access level Read