Add documentation for access control and feature availability (#21703)
* Add documentation for access control and feature availability Document the access control policies that govern feature availability in Netdata across three access levels: Anonymous (no sign-in), Netdata Cloud Community, and Netdata Cloud Business. Covers: - Why access controls exist (security for sensitive data) - Feature availability tables for metrics, functions, configuration - Sensitive functions that require authentication - AI features and their availability - Node limits and custom dashboard limits - MCP availability at agents/parents - How to enable restricted features * Add OSS limitations doc to learn site navigation * Fix inconsistent custom dashboard limit wording * Fix custom dashboard limits: per agent for OSS, per room for Cloud
Costa Tsaousis committed
Feb 5, 2026 at 02:01 UTC
c2fec131c002ee3faeb0df4ff2a8c3b172ecfbd4
2 files changed
+139
docs/.map/map.csv
+1
@@ -231,6 +231,7 @@ https://github.com/netdata/netdata/edit/master/docs/category-overview-pages/moni
231
,,,,,
232
,,,,,
233
https://github.com/netdata/netdata/edit/master/docs/security-and-privacy-design/README.md,Security and Privacy Design,Published,Security and Privacy Design,,
234
+https://github.com/netdata/netdata/edit/master/docs/netdata-oss-limitations.md,Access Control and Feature Availability,Published,Security and Privacy Design,,Feature availability across Anonymous access Netdata Cloud Community and Business tiers
235
https://github.com/netdata/netdata/edit/master/docs/security-and-privacy-design/netdata-agent-security.md,Netdata Agent,Published,Security and Privacy Design,,
236
https://github.com/netdata/netdata/edit/master/docs/security-and-privacy-design/netdata-cloud-security.md,Netdata Cloud,Published,Security and Privacy Design,,
237
,,,,,
docs/netdata-oss-limitations.md
new
+138
@@ -0,0 +1,138 @@
1
+# Netdata Access Control and Feature Availability
2
+
3
+This document explains the access control policies that govern feature availability in Netdata, and how these change based on your authentication and subscription status.
4
+
5
+## Overview
6
+
7
+Netdata implements a layered access control system to protect sensitive information while keeping core monitoring capabilities freely available. The system distinguishes between three access levels:
8
+
9
+| Access Level | Description |
10
+|--------------|-------------|
11
+| **Anonymous** | Using the Netdata dashboard without signing in |
12
+| **Netdata Cloud Community** | Signed in to Netdata Cloud (free tier) |
13
+| **Netdata Cloud Business** | Signed in with a paid subscription |
14
+
15
+## Why Access Controls Exist
16
+
17
+Netdata functions can expose sensitive system information:
18
+
19
+- **Process details** reveal running applications, command-line arguments (which may contain passwords or tokens), and resource consumption patterns
20
+- **Network connections** expose active services, connected clients, and internal network topology
21
+- **System logs** may contain application errors, security events, and debugging information with sensitive context
22
+- **Database queries** can reveal query patterns, table structures, and potentially sensitive data in error messages
23
+
24
+Without authentication, anyone who can reach the Netdata dashboard could access this information. The access control system ensures that sensitive data is only available to authenticated users who belong to the same Netdata Cloud Space as the monitored infrastructure.
25
+
26
+## Feature Availability by Access Level
27
+
28
+### Metrics and Visualization
29
+
30
+| Feature | Anonymous | Community | Business |
31
+|---------|:---------:|:---------:|:--------:|
32
+| Real-time metrics (all collectors) | ✓ | ✓ | ✓ |
33
+| Historical data and retention | ✓ | ✓ | ✓ |
34
+| Charts and dashboards | ✓ | ✓ | ✓ |
35
+| Anomaly detection (ML) | ✓ | ✓ | ✓ |
36
+| Alert notifications | ✓ | ✓ | ✓ |
37
+| Multi-node views | 5 nodes | 5 nodes | Unlimited |
38
+| Custom dashboards | 1 per agent | 1 per room | Unlimited |
39
+
40
+### Functions (Top Tab)
41
+
42
+Functions provide on-demand, detailed information beyond standard metrics.
43
+
44
+| Function | Description | Anonymous | Community | Business |
45
+|----------|-------------|:---------:|:---------:|:--------:|
46
+| **Block Devices** | Disk I/O activity | ✓ | ✓ | ✓ |
47
+| **Containers/VMs** | Container and VM resource usage | ✓ | ✓ | ✓ |
48
+| **IPMI Sensors** | Hardware sensor readings | ✓ | ✓ | ✓ |
49
+| **Mount Points** | Disk usage per mount | ✓ | ✓ | ✓ |
50
+| **Network Interfaces** | Interface traffic and status | ✓ | ✓ | ✓ |
51
+| **Systemd Services** | Service resource usage | ✓ | ✓ | ✓ |
52
+| **Processes** | Running processes, command lines, resources | ✗ | ✓ | ✓ |
53
+| **Network Connections** | Active TCP/UDP connections | ✗ | ✓ | ✓ |
54
+| **Systemd Journal** | System and application logs | ✗ | ✓ | ✓ |
55
+| **Windows Events** | Windows event logs | ✗ | ✓ | ✓ |
56
+| **Systemd Units** | Unit status and configuration | ✗ | ✓ | ✓ |
57
+| **Database Queries** | Top queries, deadlocks, errors | ✗ | ✓ | ✓ |
58
+| **Streaming Status** | Netdata streaming topology | ✗ | ✓ | ✓ |
59
+| **API Call Tracing** | Netdata API request tracing | ✗ | ✓ | ✓ |
60
+
61
+### Configuration and Management
62
+
63
+| Feature | Anonymous | Community | Business |
64
+|---------|:---------:|:---------:|:--------:|
65
+| View agent configuration | ✗ | ✗ | ✓ |
66
+| Dynamic Configuration (collectors) | ✗ | ✗ | ✓ |
67
+| Dynamic Configuration (alerts) | ✗ | ✗ | ✓ |
68
+| Alert silencing rules | ✗ | ✓ | ✓ |
69
+| Notification configuration | ✗ | ✗ | ✓ |
70
+
71
+### AI-Powered Features
72
+
73
+| Feature | Anonymous | Community | Business |
74
+|---------|:---------:|:---------:|:--------:|
75
+| Alert explanations | ✗ | ✓ | ✓ |
76
+| Alert configuration suggestions | ✗ | ✓ | ✓ |
77
+| AI-powered insights | ✗ | ✓ | ✓ |
78
+
79
+### Organization Features
80
+
81
+| Feature | Anonymous | Community | Business |
82
+|---------|:---------:|:---------:|:--------:|
83
+| Role-based access control (RBAC) | N/A | ✗ | ✓ |
84
+| Single Sign-On (SSO) | N/A | ✗ | ✓ |
85
+| Team management | N/A | Limited | Full |
86
+
87
+## MCP (Model Context Protocol)
88
+
89
+Netdata's MCP server is available directly at Netdata Agents and Parents, independent of Netdata Cloud authentication. This allows AI assistants and tools to query metrics and execute functions through the MCP protocol.
90
+
91
+When accessing Netdata via MCP:
92
+
93
+- **Without Cloud connection**: MCP can access public functions and metrics, but sensitive functions follow the same restrictions as the dashboard
94
+- **With Cloud connection**: MCP inherits the user's Cloud permissions, enabling access to sensitive functions for authenticated users
95
+
96
+For MCP setup and configuration, see the [MCP documentation](/docs/netdata-ai/mcp/README.md).
97
+
98
+## How to Enable Features
99
+
100
+### Enable Sensitive Functions
101
+
102
+1. **Sign in to Netdata Cloud** at [app.netdata.cloud](https://app.netdata.cloud)
103
+2. **Connect your nodes** to your Netdata Cloud Space
104
+3. **Access the dashboard** through Netdata Cloud
105
+
106
+Once signed in, you'll have access to all sensitive functions (processes, logs, network connections, etc.) on nodes within your Space.
107
+
108
+### Enable Dynamic Configuration
109
+
110
+Dynamic Configuration requires a Business subscription:
111
+
112
+1. **Sign in to Netdata Cloud**
113
+2. **Upgrade to Business** from the billing settings
114
+3. **Access Dynamic Configuration** from the settings menu on any connected node
115
+
116
+### Increase Node Limits
117
+
118
+The 5-node limit on multi-node dashboards applies to Community plans:
119
+
120
+1. **Upgrade to Business** for unlimited nodes
121
+2. **Or select preferred nodes** in Space settings to choose which 5 nodes appear in multi-node views
122
+
123
+## Summary
124
+
125
+| What You Get | Anonymous | Community | Business |
126
+|--------------|-----------|-----------|----------|
127
+| **Metrics & Charts** | Full access | Full access | Full access |
128
+| **Anomaly Detection** | Full access | Full access | Full access |
129
+| **Alert Notifications** | Full access | Full access | Full access |
130
+| **Public Functions** | Full access | Full access | Full access |
131
+| **Sensitive Functions** | Blocked | Full access | Full access |
132
+| **AI Features** | Blocked | Full access | Full access |
133
+| **Dynamic Configuration** | Blocked | Blocked | Full access |
134
+| **Multi-node Limit** | 5 nodes | 5 nodes | Unlimited |
135
+| **Custom Dashboards** | 1 per agent | 1 per room | Unlimited |
136
+| **RBAC & SSO** | N/A | Not available | Full access |
137
+
138
+Netdata's access control model ensures that sensitive system information is protected while keeping powerful monitoring capabilities freely available. Sign in to Netdata Cloud to unlock sensitive functions, or upgrade to Business for full configuration control and unlimited scale.