# Role Permissions

## Overview

Kloudfuse provides three roles that control what a user can do across the platform:

| Role   | Description |
| ------ | ----------- |
| Admin  | Full access to all platform features, including user management, policy configuration, and all telemetry data. |
| Editor | Can create and edit most resources. **Data visibility depends on the `default_rbac_policy` setting** — Editors with `rbac_allow_all` can query all telemetry streams, while Editors with `rbac_allow_none` are denied data access unless an explicit policy grants access. See [Default RBAC Policy](https://docs.kloudfuse.com/platform/4.1.0/administration/authorization/rbac/configuration/#configuration-default-policy). |
| Viewer | Read-only access to platform resources. **Data visibility depends on the `default_rbac_policy` setting** — Viewers with `rbac_allow_all` can query all telemetry streams, while Viewers with `rbac_allow_none` are denied data access unless an explicit policy grants access. See [Default RBAC Policy](https://docs.kloudfuse.com/platform/4.1.0/administration/authorization/rbac/configuration/#configuration-default-policy). |

Roles are assigned directly in the UI or automatically via SSO group synchronization. See [Manually Assigning User Roles](https://docs.kloudfuse.com/platform/4.1.0/administration/authorization/rbac/assignment/) and [SSO Role Groups](https://docs.kloudfuse.com/platform/4.1.0/administration/authorization/rbac/configuration/#configuration-role-groups).

## Permissions Matrix

| Permission                                | Admin | Editor | Viewer |
| ------------------------------------------ | ----- | ------ | ------ |
| USER & ACCESS MANAGEMENT                   |       |        |        |
| View / Delete Users                       | **✓** | **✗**  |        |
| Modify User Roles                         | **✓** | **✗**  |        |
| Manage Teams (as Team Admin)              | **✓** | **✓**  |        |
| Manage Teams (as Team Member)             | **✓** | View   | **✗**  |
| View Teams                                | All teams | Own teams only |        |
| View / Manage Service Accounts             | **✓** | **✗**  |        |
| View / Manage Policies                     | **✓** | **✗**  |        |
| View Folders                              | **✓** | **✓**  |        |
| Create / Edit / Delete Folders            | All folders | Folder permissions |        |
| DASHBOARDS & VISUALIZATION                 |       |        |        |
| View Dashboards                           | **✓** | **✓**  |        |
| Create / Edit / Delete Dashboards         | **✓** | Folder permissions |        |
| ALERTING & MONITORING                      |       |        |        |
| View Alerts                               | **✓** | **✓**  |        |
| Create / Edit / Delete Alert Rules        | **✓** | Folder permissions |        |
| Create / Edit / Delete Alert Contact Points| **✓** | **✓**  | **✗**  |
| Create / Edit / Delete Alert Notification Channels | **✓** | **✓**  | **✗**  |
| Create / Edit / Delete SLOs               | **✓** | View   |        |
| PLATFORM CONFIGURATION                     |       |        |        |
| RUM Applications                          | **✓** | **✓**  | View   |
| Lookup Tables                             | **✓** | **✓**  | View   |
| Scheduled Views                           | **✓** | **✓**  | View   |
| Saved Log Queries                         | **✓** | **✓**  | View   |
| Rate Control                              | **✓** | View   |        |
| Data Scrubbing                            | **✓** | View   |        |
| Favorite Facets                           | **✓** | **✓**  | View   |

**✓** Full access    View View only    **✗** No access

## Data Access

For Admin users, all telemetry data streams are always accessible. For Editor and Viewer users, data access is controlled by the `default_rbac_policy` setting or an explicit policy assigned to their team or directly to the user. See [Default RBAC Policy](https://docs.kloudfuse.com/platform/4.1.0/administration/authorization/rbac/configuration/#configuration-default-policy).

| Data Source                   | Admin | rbac_allow_all | rbac_allow_none |
| ------------------------------ | ----- | -------------- | ---------------- |
| Metrics Explorer              | **✓** | **✓**        | **✗**            |
| Logs Explorer                 | **✓** | **✓**        | **✗**            |
| APM Explorer                  | **✓** | **✓**        | **✗**            |
| Events Explorer               | **✓** | **✓**        | **✗**            |
| RUM (Real User Monitoring)    | **✓** | **✓**        | **✗**            |
| Infrastructure Monitoring      | **✓** | **✓**        | **✗**            |

**✓** Full access    **✗** No access