| 1 | # Role-Based Access Control (RBAC) |
| 2 | |
| 3 | ## Overview |
| 4 | |
| 5 | You can control what functionalities users can access in Netdata Cloud through the Role-Based Access mechanism. RBAC helps you secure your monitoring infrastructure by ensuring team members only access the data and features they need for their specific responsibilities. |
| 6 | |
| 7 | **What RBAC enables you to do:** |
| 8 | |
| 9 | - Restrict access to sensitive monitoring data |
| 10 | - Control who can modify configurations and settings |
| 11 | - Manage billing and subscription access |
| 12 | - Organize teams with appropriate permission levels |
| 13 | - Maintain audit trails of user actions |
| 14 | |
| 15 | ## Choose the Right Role |
| 16 | |
| 17 | ### Role Selection Guide |
| 18 | |
| 19 | **When assigning roles, consider:** |
| 20 | |
| 21 | | **If the user needs to...** | **Recommended Role** | |
| 22 | |:-------------------------------------------------------------------------------------------------|:---------------------| |
| 23 | | **Full system control** - manage everything including billing, users, and all configurations | **Admin** | |
| 24 | | **Team and infrastructure management** - manage users, rooms, and configurations but not billing | **Manager** | |
| 25 | | **Active troubleshooting** - investigate issues, run diagnostics, create dashboards | **Troubleshooter** | |
| 26 | | **View-only access** - monitor specific systems without making changes | **Observer** | |
| 27 | | **Billing management** - handle invoices and payments without system access | **Billing** | |
| 28 | |
| 29 | ## Quick Reference |
| 30 | |
| 31 | <details> |
| 32 | <summary><strong>Role Comparison by Plan</strong></summary><br/> |
| 33 | |
| 34 | | **Role** | **Community** | **Homelab** | **Business** | **Enterprise On-Prem** | |
| 35 | |:---------------------------------------------------------------------------------------------------------------------------------------|:------------------:|:------------------:|:------------------:|:----------------------:| |
| 36 | | **Admins** can control Spaces, Rooms, Nodes, Users and Billing. They can also access any Room in the Space. | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | |
| 37 | | **Managers** can manage Rooms and Users. They can access any Room in the Space. | - | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | |
| 38 | | **Troubleshooters** can only use Netdata to troubleshoot, not manage entities. They need to be assigned to Rooms in the Space. | - | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | |
| 39 | | **Observers** can only view data in specific Rooms.<br/> 💡 Ideal for restricting your customer's access to their own dedicated Rooms. | - | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | |
| 40 | | **Billing** can handle billing options and invoices. | - | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | |
| 41 | |
| 42 | </details> |
| 43 | |
| 44 | ### Key Permissions Summary |
| 45 | |
| 46 | | **Area** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | |
| 47 | |:---------------------|:------------:|:----------------:|:-------------------:|:-------------------:|:------------:| |
| 48 | | **Space Management** | Full control | View only | View only | View only | View only | |
| 49 | | **User Management** | Full control | Most permissions | View users in rooms | View users in rooms | None | |
| 50 | | **Room Management** | Full control | Full control | View assigned rooms | View assigned rooms | None | |
| 51 | | **Node Management** | Full control | View all nodes | None | None | None | |
| 52 | | **Billing Access** | Full control | None | None | None | Full control | |
| 53 | | **Notifications** | Full control | View only | View only | View only | None | |
| 54 | |
| 55 | ## Detailed Permissions |
| 56 | |
| 57 | <details> |
| 58 | <summary><strong>Space Management</strong></summary><br/> |
| 59 | |
| 60 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 61 | |:---------------------------|:------------------:|:------------------:|:------------------:|:------------------:|:------------------:|:----------| |
| 62 | | **See Space** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | | |
| 63 | | **Leave Space** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | | |
| 64 | | **Delete Space** | :heavy_check_mark: | - | - | - | - | | |
| 65 | | **Change name** | :heavy_check_mark: | - | - | - | - | | |
| 66 | | **Change description** | :heavy_check_mark: | - | - | - | - | | |
| 67 | | **Change slug** | :heavy_check_mark: | - | - | - | - | | |
| 68 | | **Change preferred nodes** | :heavy_check_mark: | - | - | - | - | | |
| 69 | |
| 70 | </details> |
| 71 | |
| 72 | <details> |
| 73 | <summary><strong>Node Management</strong></summary><br/> |
| 74 | |
| 75 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 76 | |:----------------------------------------------|:------------------:|:------------------:|:------------------:|:------------:|:-----------:|:----------| |
| 77 | | **See all Nodes in Space (_All Nodes_ Room)** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 78 | | **Connect Node to Space** | :heavy_check_mark: | - | - | - | - | | |
| 79 | | **Delete Node from Space** | :heavy_check_mark: | - | - | - | - | | |
| 80 | |
| 81 | </details> |
| 82 | |
| 83 | <details> |
| 84 | <summary><strong>User Management</strong></summary><br/> |
| 85 | |
| 86 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 87 | |:---------------------------------------|:------------------:|:------------------:|:------------------:|:------------------:|:-----------:|:----------| |
| 88 | | **See all Users in Space** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 89 | | **Invite new User to Space** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 90 | | **Delete Pending Invitation to Space** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 91 | | **Delete User from Space** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 92 | | **Appoint Administrators** | :heavy_check_mark: | - | - | - | - | | |
| 93 | | **Appoint Billing user** | :heavy_check_mark: | - | - | - | - | | |
| 94 | | **Appoint Managers** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 95 | | **Appoint Troubleshooters** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 96 | | **Appoint Observer** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 97 | | **Appoint Member** | :heavy_check_mark: | - | - | - | - | | |
| 98 | | **See all Users in a Room** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 99 | | **Invite existing user to Room** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 100 | | **Remove user from Room** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 101 | |
| 102 | </details> |
| 103 | |
| 104 | <details> |
| 105 | <summary><strong>Room Management</strong></summary><br/> |
| 106 | |
| 107 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 108 | |:---------------------------------|:------------------:|:------------------:|:------------------:|:------------------:|:-----------:|:----------| |
| 109 | | **See all Rooms in a Space** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 110 | | **Join any Room in a Space** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 111 | | **Leave Room** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 112 | | **Create a new Room in a Space** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 113 | | **Delete Room** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 114 | | **Change Room name** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 115 | | **Change Room description** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 116 | | **Add existing Nodes to Room** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 117 | | **Remove Nodes from Room** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 118 | |
| 119 | </details> |
| 120 | |
| 121 | <details> |
| 122 | <summary><strong>Notification Management</strong></summary><br/> |
| 123 | |
| 124 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 125 | |:------------------------------------------------------------------------------|:------------------:|:------------------:|:------------------:|:------------------:|:------------------:|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |
| 126 | | **See all configured notifications on a Space** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 127 | | **Add new configuration** | :heavy_check_mark: | - | - | - | - | | |
| 128 | | **Enable/Disable configuration** | :heavy_check_mark: | - | - | - | - | | |
| 129 | | **Edit configuration** | :heavy_check_mark: | - | - | - | - | Some exceptions apply depending on [service level](/docs/alerts-and-notifications/notifications/centralized-cloud-notifications/manage-notification-methods.md#available-actions-per-notification-method-based-on-service-level) | |
| 130 | | **Delete configuration** | :heavy_check_mark: | - | - | - | - | | |
| 131 | | **Edit personal level notification settings** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | [Manage user notification settings](/docs/alerts-and-notifications/notifications/centralized-cloud-notifications/manage-notification-methods.md#manage-user-notification-settings) | |
| 132 | | **See Space Alert notification silencing rules** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - | | |
| 133 | | **Add new Space Alert notification silencing rule** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 134 | | **Enable/Disable Space Alert notification silencing rule** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 135 | | **Edit Space Alert notification silencing rule** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 136 | | **Delete Space Alert notification silencing rule** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 137 | | **See, add, edit or delete personal level Alert notification silencing rule** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 138 | |
| 139 | </details> |
| 140 | |
| 141 | <details> |
| 142 | <summary><strong>Dashboards</strong></summary><br/> |
| 143 | |
| 144 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 145 | |:---------------------------------|:------------------:|:------------------:|:------------------:|:------------------:|:-----------:|:----------| |
| 146 | | **See all dashboards in Room** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 147 | | **Add new dashboard to Room** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 148 | | **Edit any dashboard in Room** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - | | |
| 149 | | **Edit own dashboard in Room** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 150 | | **Delete any dashboard in Room** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - | | |
| 151 | | **Delete own dashboard in Room** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 152 | |
| 153 | </details> |
| 154 | |
| 155 | <details> |
| 156 | <summary><strong>Functions</strong></summary><br/> |
| 157 | |
| 158 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 159 | |:-----------------------------------|:------------------:|:------------------:|:------------------:|:------------------:|:-----------:|:----------| |
| 160 | | **See all functions in Room** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 161 | | **Run any function in Room** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 162 | | **Run read-only function in Room** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 163 | | **Run sensitive function in Room** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 164 | |
| 165 | </details> |
| 166 | |
| 167 | <details> |
| 168 | <summary><strong>Events Tab</strong></summary><br/> |
| 169 | |
| 170 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 171 | |:---------------------------------|:------------------:|:------------------:|:------------------:|:------------------:|:-----------:|:----------| |
| 172 | | **See Alert or Topology events** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 173 | | **See Auditing events** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 174 | |
| 175 | </details> |
| 176 | |
| 177 | <details> |
| 178 | <summary><strong>Billing</strong></summary><br/> |
| 179 | |
| 180 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 181 | |:-------------------------------|:------------------:|:-----------:|:------------------:|:------------:|:------------------:|:----------------------------------------------------------------| |
| 182 | | **See Plan & Billing details** | :heavy_check_mark: | - | - | - | :heavy_check_mark: | Current plan and usage figures | |
| 183 | | **Update plans** | :heavy_check_mark: | - | - | - | - | This includes cancelling current plan (going to Community plan) | |
| 184 | | **See invoices** | :heavy_check_mark: | - | - | - | :heavy_check_mark: | | |
| 185 | | **Manage payment methods** | :heavy_check_mark: | - | - | - | :heavy_check_mark: | | |
| 186 | | **Update billing email** | :heavy_check_mark: | - | - | - | :heavy_check_mark: | | |
| 187 | |
| 188 | </details> |
| 189 | |
| 190 | <details> |
| 191 | <summary><strong>Dynamic Configuration Manager</strong></summary><br/> |
| 192 | |
| 193 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 194 | |:------------------------------------------|:------------------:|:------------------:|:------------------:|:------------------:|:------------------:|:----------| |
| 195 | | **List All (see all configurable items)** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | | |
| 196 | | **Enable/Disable** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 197 | | **Add** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 198 | | **Update** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 199 | | **Remove** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 200 | | **Test** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 201 | | **View** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 202 | | **View File Format** | :heavy_check_mark: | :heavy_check_mark: | - | - | - | | |
| 203 | |
| 204 | </details> |
| 205 | |
| 206 | <details> |
| 207 | <summary><strong>Other Permissions</strong></summary><br/> |
| 208 | |
| 209 | | **Functionality** | **Admin** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | **Notes** | |
| 210 | |:-------------------------------|:------------------:|:------------------:|:------------------:|:------------------:|:-----------:|:----------| |
| 211 | | **See Bookmarks in Space** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 212 | | **Add Bookmark to Space** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - | | |
| 213 | | **Delete Bookmark from Space** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - | | |
| 214 | | **See Visited Nodes** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 215 | | **Update Visited Nodes** | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | | |
| 216 | |
| 217 | </details><br/> |
| 218 | |
| 219 | :::note |
| 220 | |
| 221 | Enable, Edit and Add actions over specific notification methods will only be allowed if your plan has access to those (see [service classification](/docs/alerts-and-notifications/notifications/centralized-cloud-notifications/centralized-cloud-notifications-reference.md#service-classification)) |
| 222 | |
| 223 | ::: |
| 224 | |
| 225 | :::note |
| 226 | |
| 227 | A Netdata Cloud paid plan is required for all actions except "List All" in Dynamic Configuration Manager. |
| 228 | |
| 229 | ::: |