Permissions
- Action definitions
- Scope definitions

Permissions

A permission is an action and a scope. When creating a fine-grained access control, consider what specific action a user should be allowed to perform, and on what resources (its scope).

To grant permissions to a user, you create a built-in role assignment to map a role to a built-in role. A built-in role assignment modifies to one of the existing built-in roles in Grafana (Viewer, Editor, Admin). For more information, refer to Built-in role assignments.

To learn more about which permissions are used for which resources, refer to Resources with fine-grained permissions.

action

The specific action on a resource defines what a user is allowed to perform if they have permission with the relevant action assigned to it.

scope

The scope describes where an action can be performed, such as reading a specific user profile. In such case, a permission is associated with the scope users:<userId> to the relevant role.

Action definitions

The following list contains fine-grained access control actions.

Action	Applicable scope	Description
`roles:list`	`roles:`	List available roles without permissions.
`roles:read`	`roles:`	Read a specific role with its permissions.
`roles:write`	`permissions:delegate`	Create or update a custom role.
`roles:delete`	`permissions:delegate`	Delete a custom role.
`roles.builtin:list`	`roles:`	List built-in role assignments.
`roles.builtin:add`	`permissions:delegate`	Create a built-in role assignment.
`roles.builtin:remove`	`permissions:delegate`	Delete a built-in role assignment.
`reports.admin:create`	`reports:`	Create reports.
`reports.admin:write`	`reports:`	Update reports.
`reports:delete`	`reports:`	Delete reports.
`reports:read`	`reports:`	List all available reports or get a specific report.
`reports:send`	`reports:`	Send a report email.
`reports.settings:write`	n/a	Update report settings.
`reports.settings:read`	n/a	Read report settings.
`provisioning:reload`	`provisioners:`	Reload provisioning files. To find the exact scope for specific provisioner, see Scope definitions.
`users:read`	`global:users:`	Read or search user profiles.
`users:write`	`global:users:`	Update a user’s profile.
`users.teams:read`	`global:users:`	Read a user’s teams.
`users.authtoken:list`	`global:users:`	List authentication tokens that are assigned to a user.
`users.authtoken:update`	`global:users:`	Update authentication tokens that are assigned to a user.
`users.password:update`	`global:users:`	Update a user’s password.
`users:delete`	`global:users:`	Delete a user.
`users:create`	n/a	Create a user.
`users:enable`	`global:users:`	Enable a user.
`users:disable`	`global:users:`	Disable a user.
`users.permissions:update`	`global:users:`	Update a user’s organization-level permissions.
`users:logout`	`global:users:`	Sign out a user.
`users.quotas:list`	`global:users:`	List a user’s quotas.
`users.quotas:update`	`global:users:`	Update a user’s quotas.
`org.users:read`	`users:`	Get user profiles within an organization.
`org.users:add`	`users:`	Add a user to an organization.
`org.users:remove`	`users:`	Remove a user from an organization.
`org.users.role:update`	`users:`	Update the organization role (`Viewer`, `Editor`, or `Admin`) of an organization.
`ldap.user:read`	n/a	Get a user via LDAP.
`ldap.user:sync`	n/a	Sync a user via LDAP.
`ldap.status:read`	n/a	Verify the availability of the LDAP server or servers.
`ldap.config:reload`	n/a	Reload the LDAP configuration.
`status:accesscontrol`	`services:accesscontrol`	Get access-control enabled status.
`settings:read`	`settings:` `settings:auth.saml:` `settings:auth.saml:enabled` (property level)	Read the Grafana configuration settings
`settings:write`	`settings:` `settings:auth.saml:` `settings:auth.saml:enabled` (property level)	Update any Grafana configuration settings that can be updated at runtime.
`server.stats:read`	n/a	Read server stats
`datasources:explore`	n/a	Enable access to the Explore tab.
`datasources:read`	n/a `datasources:` `datasources:id:` `datasources:uid:` `datasources:name:`	List data sources.
`datasources.id:read`	`datasources:` `datasources:name:`	Read data source IDs.
`datasources:create`	n/a	Create data sources.
`datasources:write`	`datasources:` `datasources:id:`	Update data sources.
`datasources:delete`	`datasources:id:` `datasources:uid:` `datasources:name:`	Delete data sources.
`datasources.permissions:read`	`datasources:` `datasources:id:`	List data source permissions.
`datasources.permissions:create`	`datasources:` `datasources:id:`	Create data source permissions.
`datasources.permissions:delete`	`datasources:` `datasources:id:`	Delete data source permissions.
`datasources.permissions:toggle`	`datasources:` `datasources:id:*`	Enable or disable data source permissions.

Scope definitions

The following list contains fine-grained access control scopes.

Scopes	Descriptions
`roles:`	Restrict an action to a set of roles. For example, `roles:` matches any role, `roles:randomuid` matches only the role with UID `randomuid` and `roles:custom:reports:{editor,viewer}` matches both `custom:reports:editor` and `custom:reports:viewer` roles.
`permissions:delegate`	The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment.
`reports:`	Restrict an action to a set of reports. For example, `reports:` matches any report and `reports:1` matches the report with id `1`.
`services:accesscontrol`	Restrict an action to target only the fine-grained access control service. You can use this in conjunction with the `status:accesscontrol` actions.
`global:users:`	Restrict an action to a set of global users.
`users:`	Restrict an action to a set of users from an organization.
`settings:`	Restrict an action to a subset of settings. For example, `settings:` matches all settings, `settings:auth.saml:` matches all SAML settings, and `settings:auth.saml:enabled` matches the enable property on the SAML settings.
`provisioners:`	Restrict an action to a set of provisioners. For example, `provisioners:` matches any provisioner, and `provisioners:accesscontrol` matches the fine-grained access control provisioner.
`datasources:` `datasources:id:` `datasources:uid:` `datasources:name:`	Restrict an action to a set of data sources. For example, `datasources:` matches any data source, and `datasources:name:postgres` matches the data source named `postgres`.