Role-based access control (RBAC)

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/use-cases/observability/clickstack/managing/rbac.md)

ClickStack includes role-based access control (RBAC) so you can define custom roles with fine-grained permissions over [dashboards](/docs/use-cases/observability/clickstack/dashboards), [saved searches](/docs/use-cases/observability/clickstack/search), sources, [alerts](/docs/use-cases/observability/clickstack/alerts), webhooks, and notebooks. Permissions work at two levels: resource-level access (no access, read, or manage per resource type) and optional fine-grained rules that restrict access to individual resources by name, tag, or ID. ClickStack ships with three built-in roles, and you can create custom roles to match your team's needs.

Managed ClickStack only

RBAC is only available in Managed ClickStack deployments.

## User access prerequisites[​](#user-access-prerequisites "Direct link to User access prerequisites")

ClickStack authenticates through ClickHouse Cloud. Before you can assign ClickStack roles, each user must:

1. **Be invited to your ClickHouse Cloud organization.** An organization admin invites users from the Cloud console. See [Manage cloud users](/docs/cloud/security/manage-cloud-users) for details.
2. **Have SQL Console access on the service.** Navigate to your service's **Settings** → **SQL Console Access** and set the appropriate permission level:

|  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Cloud SQL Console access ClickStack access|  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | | **SQL Console Admin** (Full Access) Full access to ClickStack. Required for enabling [alerts](/docs/use-cases/observability/clickstack/alerts).| **SQL Console Read Only** (Read Only) Can view observability data and create dashboards.|  |  | | --- | --- | | **No access** Can't access ClickStack. | | | | | | | |

Once a user has Cloud access, they appear in the ClickStack **Team Settings** page where you can assign a ClickStack role.

- Cloud Users and roles- ClickStack Team Settings

## Built-in roles[​](#built-in-roles "Direct link to Built-in roles")

ClickStack includes three system roles. You can't edit or delete these. The Admin role is assigned to the team creator by default.

|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Permission Admin Member ReadOnly|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Read all resources ✓ ✓ ✓|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Manage dashboards ✓ ✓ |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Manage saved searches ✓ ✓ |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Manage sources ✓ ✓ |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Manage alerts ✓ ✓ |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Manage webhooks ✓ ✓ |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Manage notebooks ✓ ✓ |  |  |  |  |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Update team settings ✓ ✓ |  |  |  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | --- | --- | | Create/delete teams ✓ |  |  |  |  | | --- | --- | --- | --- | | Manage users and invitations ✓ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

## Assigning roles to team members[​](#assigning-roles "Direct link to Assigning roles to team members")

The **Team Settings** page lists all team members with their current role. To change a role, click **Edit** next to the user's name and select a new role. Each user has exactly one role.

### Default new user role[​](#default-new-user-role "Direct link to Default new user role")

You can set a default role for new users under [Security policies](#security-policies). New users who auto-join the team are automatically assigned this role.

## Creating a custom role[​](#creating-a-role "Direct link to Creating a custom role")

Navigate to Team Settings

### Navigate to Team Settings[​](#step-navigate "Direct link to Navigate to Team Settings")

Open **Team Settings** and scroll to **RBAC Roles**.

Add a new role

### Add a new role[​](#step-add-role "Direct link to Add a new role")

Click **+ Add Role**. Enter a **Role Name** and optionally add a **Description**.

Configure permissions and save

### Configure permissions and save[​](#step-configure "Direct link to Configure permissions and save")

Set permissions for the role, then click **Create Role**.

Custom roles appear alongside system roles in the RBAC Roles section, with **Edit** and **Delete** controls.

## Role permissions[​](#role-permissions "Direct link to Role permissions")

### Resource permissions[​](#resource-permissions "Direct link to Resource permissions")

Each role grants an access level per resource type. The three levels are:

|  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Access level What it allows|  |  |  |  |  |  | | --- | --- | --- | --- | --- | --- | | **No Access** The resource type is hidden from the role entirely.|  |  |  |  | | --- | --- | --- | --- | | **Read** View the resource and its configuration, but not create, edit, or delete it.|  |  | | --- | --- | | **Manage** Full control — create, edit, and delete resources of that type. | | | | | | | |

The resource types you can control are:

- **[Dashboards](/docs/use-cases/observability/clickstack/dashboards)** — saved dashboard layouts and charts.
- **[Saved searches](/docs/use-cases/observability/clickstack/search)** — persisted log/trace/event queries.
- **Sources** — ingestion source configurations.
- **[Alerts](/docs/use-cases/observability/clickstack/alerts)** — alert rules and their notification settings.
- **Webhooks** — outbound notification destinations (such as Slack, PagerDuty, and generic HTTP endpoints) that [alerts](/docs/use-cases/observability/clickstack/alerts) deliver to. This doesn't refer to the ClickStack API.
- **Notebooks** — collaborative investigation notebooks.

### Administrative permissions[​](#administrative-permissions "Direct link to Administrative permissions")

In addition to resource permissions, each role includes two administrative settings: