Roles and permissions#
Access control is per organisation. Every person belongs to one or more organisations, and holds a role in each.
Roles#
| Role | Can do | Cannot do |
|---|---|---|
| Owner | Everything, including billing, deleting the organisation and changing other owners | Nothing is withheld |
| Admin | Manage integrations, dashboards, alerts, monitors, on-call and members | Billing, deleting the organisation, changing owner roles |
| Member | View everything, create and edit dashboards, monitors and alerts | Manage integrations, credentials, members or billing |
The dividing line between admin and member is credentials. A member can build anything and be alerted on anything, but cannot see or change the connections that hold access to your systems.
There is no read-only role that blocks dashboard creation. Members can create and edit dashboards. If you need people who can only look, raise it with us rather than working around it by not inviting them.
Inviting people#
Settings → Members → Invite. Enter the email address and choose the role. The invitation expires after seven days.
The person receives an email with a link. If your organisation uses single sign-on, they authenticate through your identity provider instead of setting a password.
Changing and removing access#
Change a role from the members list. Owners can change any role; admins can change members but not owners.
Removing someone revokes access immediately, including active sessions. Dashboards, monitors and alerts they created remain, because they belong to the organisation rather than the person.
Removing a member does not revoke API keys they created. API keys belong to the organisation and continue to work. Review Settings → API keys when someone leaves and revoke any key they created.
API keys#
API keys authenticate telemetry ingest and API access. They carry organisation-level access rather than a personal role.
Good practice:
- One key per purpose: one for host agents, one per application, one for CI. When one leaks you revoke it without taking everything else down.
- Set an expiry. A key with no expiry outlives the reason it was created.
- Rotate by creating the new key, moving traffic to it, confirming, then revoking the old one. Revoking first causes an outage in telemetry.
Multiple organisations#
Separate organisations are the right boundary when data must not be visible across teams, for example between business units or between a managed service provider's customers. Each has its own members, integrations, retention and billing. Data is isolated where it is stored, not only in the interface.
Within one organisation everyone sees the same data, so use organisations rather than trying to partition a single one.
Audit log#
Settings → Audit log records configuration changes: who changed a rule, who added or removed an integration, who invited or removed a member, and when. Filter by actor, action type or period, and export for review.