> ## Documentation Index
> Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Role-based access control (RBAC)

> Configure role-based access control in ClickHouse Observability to manage team permissions for dashboards, saved searches, sources, alerts, and more.

[Beta offering](https://clickhouse.com/docs/reference/settings/beta-and-experimental-features.md#beta-features)

ClickHouse Observability includes role-based access control (RBAC) so you can define custom roles with fine-grained permissions over [dashboards](https://clickhouse.com/docs/clickstack/observability/features/dashboards/overview.md), [saved searches](https://clickhouse.com/docs/clickstack/observability/features/search.md), sources, [alerts](https://clickhouse.com/docs/clickstack/observability/features/alerts.md), webhooks, and notebooks. Permissions work at two levels: resource-level access (no access, read, or manage per resource type) and optional fine-grained rules that restrict access to individual resources by name, tag, or ID. The service ships with three built-in roles, and you can create custom roles to match your team's needs.

## User access prerequisites

The service authenticates through ClickHouse Cloud. Users must belong to your ClickHouse Cloud organization and have access to the Observability service. See [Manage cloud users](https://clickhouse.com/docs/products/cloud/guides/security/cloud-access-management/manage-cloud-users.md) for organization membership.

The Cloud SQL Console access levels map to Observability access as follows:

| Cloud SQL Console access | Observability access |
| - | - |
| **SQL Console Admin** (Full Access) | Full access to the service. Required for enabling [alerts](https://clickhouse.com/docs/clickstack/observability/features/alerts.md). |
| **SQL Console Read Only** (Read Only) | Can view observability data and create dashboards. |
| **No access** | Can't access the service. |

Open **Team Settings → Members & Roles** to view team members and their current Observability roles. Select **Manage in Console** to manage organization membership in ClickHouse Cloud.

## Built-in roles

The service includes three system roles. You can't edit or delete these. The Admin role is assigned to the team creator by default.

| Permission | Admin | Member | ReadOnly |
| - | :-: | :-: | :-: |
| Read all resources | ✓ | ✓ | ✓ |
| Manage dashboards | ✓ | ✓ | |
| Manage saved searches | ✓ | ✓ | |
| Manage sources | ✓ | ✓ | |
| Manage alerts | ✓ | ✓ | |
| Manage webhooks | ✓ | ✓ | |
| Manage notebooks | ✓ | ✓ | |
| Update team settings | ✓ | ✓ | |
| Create/delete teams | ✓ | | |
| Manage users and invitations | ✓ | | |

## Assigning roles to team members

The **Members & Roles** tab in **Team Settings** lists team members with their current role. To change a role, click **Edit** next to the user's name and select a new role. Each user has exactly one role.

### Default new user role

Under **Team Settings** → **Members & Roles**, use **Default New User Role** below the roles list to choose the role assigned to users who auto-join the team. If no default is set, new users receive the **Member** role.

## Creating a custom role

**1. Navigate to Team Settings**

Open **Team Settings** → **Members & Roles** and find **RBAC Roles**.

![RBAC Roles](https://mintcdn.com/private-7c7dfe99/y4_YksnkJMz9sseb/images/clickstack/rbac/rbac-section.webp?fit=max\&auto=format\&n=y4_YksnkJMz9sseb\&q=85\&s=47ad37cb1210050ff71cdb1bec758754)

**2. Add a new role**

Click **+ Add Role**. Enter a **Role Name** and optionally add a **Description**.

**3. Configure permissions and save**

Set permissions for the role, then click **Create Role**.

![Add Role modal](https://mintcdn.com/private-7c7dfe99/y4_YksnkJMz9sseb/images/clickstack/rbac/add-role-modal.webp?fit=max\&auto=format\&n=y4_YksnkJMz9sseb\&q=85\&s=e8c465b55c5f6f2c11cf58a89eae1518)

Custom roles appear alongside system roles in the RBAC Roles section, with **Edit** and **Delete** controls.

## Role permissions

### Resource permissions

Each role grants an access level per resource type. The three levels are:

| Access level | What it allows |
| - | - |
| **No Access** | The resource type is hidden from the role entirely. |
| **Read** | View the resource and its configuration, but not create, edit, or delete it. |
| **Manage** | Full control — create, edit, and delete resources of that type. |

The resource types you can control are:

* **[Dashboards](https://clickhouse.com/docs/clickstack/observability/features/dashboards/overview.md)** — saved dashboard layouts and charts.
* **[Saved searches](https://clickhouse.com/docs/clickstack/observability/features/search.md)** — persisted log/trace/event queries.
* **Sources** — data sources used to query observability data.
* **[Alerts](https://clickhouse.com/docs/clickstack/observability/features/alerts.md)** — alert rules and their notification settings.
* **Webhooks** — outbound notification destinations (such as Slack, PagerDuty, and generic HTTP endpoints) that [alerts](https://clickhouse.com/docs/clickstack/observability/features/alerts.md) deliver to. This doesn't refer to the observability API.
* **Notebooks** — collaborative investigation notebooks.

### Administrative permissions

In addition to resource permissions, each role includes two administrative settings:

* **Users** (No Access · Read) — controls whether the role can view team members and their roles. Manage organization membership through **Manage in Console**.
* **Team** (Read · Manage) — controls whether the role can view or modify team-level settings such as security policies and RBAC configuration.

### Fine-grained access rules

Dashboards, Saved Searches, Sources, and Notebooks support fine-grained controls that restrict access to individual resources within a category. Use these when you need to limit a role to specific resources rather than granting blanket access to the entire resource type.

#### Default access vs. fine-grained controls

Each resource type has an **Access Control Mode**:

* **Default Access** — applies a single access level (No Access, Read, or Manage) to all resources of that type.
* **Fine-Grained Controls** — lets you define access rules that match specific resources by condition. Resources that don't match any rule default to no access.

To switch modes, click the chevron to expand a resource type in the role editor, then toggle the **Access Control Mode**.

![Default Access vs Fine-Grained Controls modes in the role editor](https://mintcdn.com/private-7c7dfe99/y4_YksnkJMz9sseb/images/clickstack/rbac/default-vs-fine-grained.webp?fit=max\&auto=format\&n=y4_YksnkJMz9sseb\&q=85\&s=7cf734d2e40b0e765b4fe7a33fc3053c)

#### Configuring access rules

Each access rule consists of a **condition** and an **access level**. Conditions match resources by their properties:

![Condition tooltip: match resources by Name or Tag (shown by the title) or by ID (found in the URL)](https://mintcdn.com/private-7c7dfe99/y4_YksnkJMz9sseb/images/clickstack/rbac/condition-tip.webp?fit=max\&auto=format\&n=y4_YksnkJMz9sseb\&q=85\&s=fa901b8ced01724693eb4f5025498b02)

| Condition field | Operators | What it matches | Example |
| - | - | - | - |
| **Name** | `is`, `contains` | The display name of the resource — for example, the dashboard title. | Name contains `production` — matches any dashboard with "production" in its title. |
| **Tag** | `is`, `contains` | Tags assigned to the resource via the tag panel in the top-right corner of the resource view. Available for Dashboards, Saved Searches, and Notebooks only. | Tag is `critical` — matches resources tagged "critical." |
| **ID** | `is`, `contains` | The resource identifier, found in the URL bar when you open the resource. | ID is `abc123` — matches a single specific resource. |

The following screenshot shows both the dashboard ID highlighted in the URL bar and a "TESTING" tag visible in the tag panel (top-right).

![Dashboard showing the resource ID in the URL bar and a tag in the top-right corner](https://mintcdn.com/private-7c7dfe99/y4_YksnkJMz9sseb/images/clickstack/rbac/dashboard-id-and-tag-example.webp?fit=max\&auto=format\&n=y4_YksnkJMz9sseb\&q=85\&s=eb3fc0786d2f089a183e873de51da51e)

You can add multiple rules per resource type. Each rule is checked independently using OR logic — a resource is accessible if it matches **any** rule. Resources that don't match any rule aren't accessible.

![Access rules with OR logic tooltip](https://mintcdn.com/private-7c7dfe99/y4_YksnkJMz9sseb/images/clickstack/rbac/access-rules-tip.webp?fit=max\&auto=format\&n=y4_YksnkJMz9sseb\&q=85\&s=ac4d743e6d13a1b1b95febd18e13e399)

**Example**: To give a role read-only access to testing dashboards, expand Dashboards, switch to Fine-Grained Controls, and add two rules:

* **Name** `contains` `testing` with access level **Read**
* **Tag** `is` `testing` with access level **Read**

A dashboard that matches either rule is accessible.

![Two fine-grained access rules joined by OR: Name contains testing with Read access, and Tag is testing with Read access](https://mintcdn.com/private-7c7dfe99/y4_YksnkJMz9sseb/images/clickstack/rbac/dashboard-fine-grained-example.webp?fit=max\&auto=format\&n=y4_YksnkJMz9sseb\&q=85\&s=048e858e80e9e1f55e4a8961b3bb5a13)

## Security policies

Under **Team Settings → Members & Roles → Security Policies**, **Disable data exports** hides download and copy controls for log data, including row details, for everyone on the team. Users can still select text on screen, and the API and MCP server still return data. This setting does not prevent access to the underlying data.

Generative AI controls are under **Team Settings → API & Agents → Configure Generative AI**. See [Configure Generative AI](https://clickhouse.com/docs/clickstack/observability/managing/config.md#generative-ai) for details.