diff --git a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
index 1276f049da2..5dcbb5b8ea3 100644
--- a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
+++ b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
@@ -201,23 +201,25 @@ The following list contains role-based access control actions used by Grafana Ad
### Grafana Alerting Notification action definitions
-To enable these permissions, enable the `alertingApiServer` feature toggle.
+To use these permissions, enable the `alertingApiServer` feature toggle.
-| Action | Applicable scopes | Description |
-| -------------------------------------------- | ---------------------------------- | --------------------------------------------------------------------------------------------------------------- |
-| `alert.notifications.receivers:read` | `receivers:*`
`receivers:uid:*` | Read contact points. None |
-| `alert.notifications.receivers.secrets:read` | `receivers:*`
`receivers:uid:*` | Export contact points with decrypted secrets.None |
-| `alert.notifications.receivers:create` | None | Create a new contact points. The creator is automatically granted full access to the created contact point.None |
-| `alert.notifications.receivers:write` | `receivers:*`
`receivers:uid:*` | Update existing contact points.None |
-| `alert.notifications.receivers:delete` | `receivers:*`
`receivers:uid:*` | Update and delete existing contact points.None |
-| `receivers.permissions:read` | `receivers:*`
`receivers:uid:*` | Read permissions for contact points.None |
-| `receivers.permissions:write` | `receivers:*`
`receivers:uid:*` | Manage permissions for contact points.None |
-| `alert.notifications.time-intervals:read` | None | Read mute time intervals.None |
-| `alert.notifications.time-intervals:write` | None | Create new or update existing mute time intervals.None |
-| `alert.notifications.time-intervals:delete` | None | Delete existing time intervals.None |
-| `alert.notifications.templates:read` | None | Read templates. |
-| `alert.notifications.templates:write` | None | Create new or update existing templates.None |
-| `alert.notifications.templates:delete` | None | Delete existing templates.None |
+| Action | Applicable scopes | Description |
+| -------------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| `alert.notifications.receivers:read` | `receivers:*`
`receivers:uid:*` | Read contact points. |
+| `alert.notifications.receivers.secrets:read` | `receivers:*`
`receivers:uid:*` | Export contact points with decrypted secrets. |
+| `alert.notifications.receivers:create` | None | Create a new contact points. The creator is automatically granted full access to the created contact point. |
+| `alert.notifications.receivers:write` | `receivers:*`
`receivers:uid:*` | Update existing contact points. |
+| `alert.notifications.receivers:delete` | `receivers:*`
`receivers:uid:*` | Update and delete existing contact points. |
+| `receivers.permissions:read` | `receivers:*`
`receivers:uid:*` | Read permissions for contact points. |
+| `receivers.permissions:write` | `receivers:*`
`receivers:uid:*` | Manage permissions for contact points. |
+| `alert.notifications.time-intervals:read` | None | Read mute time intervals. |
+| `alert.notifications.time-intervals:write` | None | Create new or update existing mute time intervals. |
+| `alert.notifications.time-intervals:delete` | None | Delete existing time intervals. |
+| `alert.notifications.templates:read` | None | Read templates. |
+| `alert.notifications.templates:write` | None | Create new or update existing templates. |
+| `alert.notifications.templates:delete` | None | Delete existing templates. |
+| `alert.notifications.routes:read` | None | Read notification policies. |
+| `alert.notifications.routes:write` | None | Create new, update or delete notification policies |
## Scope definitions
diff --git a/docs/sources/alerting/set-up/configure-rbac/_index.md b/docs/sources/alerting/set-up/configure-rbac/_index.md
index 6a15d86e724..647ef8ed535 100644
--- a/docs/sources/alerting/set-up/configure-rbac/_index.md
+++ b/docs/sources/alerting/set-up/configure-rbac/_index.md
@@ -52,7 +52,7 @@ Grafana Alerting has the following permissions.
| `alert.provisioning:write` | n/a | Update all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and data source are not required. |
| `alert.provisioning.provenance:write` | n/a | Set provisioning status for alerting resources. Cannot be used alone. Requires user to have permissions to access resources |
-Contact point permissions. To enable these permissions, enable the `alertingApiServer` feature toggle.
+Contact point permissions. To enable API and user interface that use these permissions, enable the `alertingApiServer` feature toggle.
| Action | Applicable scope | Description |
| -------------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------- |
@@ -64,7 +64,7 @@ Contact point permissions. To enable these permissions, enable the `alertingApiS
| `receivers.permissions:read` | `receivers:*`
`receivers:uid:*` | Read permissions for contact points. |
| `receivers.permissions:write` | `receivers:*`
`receivers:uid:*` | Manage permissions for contact points. |
-Mute time interval permissions. To enable these permissions, enable the `alertingApiServer` feature toggle.
+Mute time interval permissions. To enable API and user interface that use these permissions, enable the `alertingApiServer` feature toggle.
| Action | Applicable scope | Description |
| ------------------------------------------- | ---------------- | -------------------------------------------------- |
@@ -80,4 +80,11 @@ Notification template permissions. To enable these permissions, enable the `aler
| `alert.notifications.templates:write` | n/a | Create new or update existing templates. |
| `alert.notifications.templates:delete` | n/a | Delete existing templates. |
+Notification policies permissions. To enable API and user interface that use these permissions, enable the `alertingApiServer` feature toggle.
+
+| Action | Applicable scope | Description |
+| ---------------------------------- | ---------------- | ---------------------------------------------------- |
+| `alert.notifications.routes:read` | n/a | Read notification policies. |
+| `alert.notifications.routes:write` | n/a | Create new, update and update notification policies. |
+
To help plan your RBAC rollout strategy, refer to [Plan your RBAC rollout strategy](https://grafana.com/docs/grafana/next/administration/roles-and-permissions/access-control/plan-rbac-rollout-strategy/).
diff --git a/docs/sources/alerting/set-up/configure-rbac/access-roles/index.md b/docs/sources/alerting/set-up/configure-rbac/access-roles/index.md
index 2c9f3efa4db..b6bb3145053 100644
--- a/docs/sources/alerting/set-up/configure-rbac/access-roles/index.md
+++ b/docs/sources/alerting/set-up/configure-rbac/access-roles/index.md
@@ -43,19 +43,19 @@ Fixed roles provide users more granular access to create, view, and update Alert
Details of the fixed roles and the access they provide for Grafana Alerting are below.
-| Display name in UI / Fixed role | Permissions | Description |
-| ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Silences Writer: `fixed:alerting.instances:writer` | All permissions from `fixed:alerting.instances:reader` and
`alert.instances:create`
`alert.instances:write` for organization scope
`alert.instances.external:write` for scope `datasources:*` | Add and update silences in Grafana and external providers. |
-| Instances and Silences Reader: `fixed:alerting.instances:reader` | `alert.instances:read` for organization scope
`alert.instances.external:read` for scope `datasources:*` | Read alert instances and silences in Grafana and external providers. |
-| Notifications Writer: `fixed:alerting.notifications:writer` | All permissions from `fixed:alerting.notifications:reader` and
`alert.notifications:write`for organization scope
`alert.notifications.external:read` for scope `datasources:*` | Add, update, and delete notification policies and contact points in Grafana and external providers. |
-| Notifications Reader: `fixed:alerting.notifications:reader` | `alert.notifications:read` for organization scope
`alert.notifications.external:read` for scope `datasources:*` | Read notification policies and contact points in Grafana and external providers. |
-| Rules Writer: `fixed:alerting.rules:writer` | All permissions from `fixed:alerting.rules:reader` and
`alert.rule:create`
`alert.rule:write`
`alert.rule:delete`
`alert.silences:create`
`alert.silences:write` for scope `folders:*`
`alert.rules.external:write` for scope `datasources:*` | Create, update, and delete all alert rules and manage rule-specific silences. |
-| Rules Reader: `fixed:alerting.rules:reader` | `alert.rule:read`, `alert.silences:read` for scope `folders:*`
`alert.rules.external:read` for scope `datasources:*`
`alert.notifications.time-intervals:read`
`alert.notifications.receivers:list` | Read all alert rules and rule-specific silences in Grafana and external providers. |
-| Full access: `fixed:alerting:writer` | All permissions from `fixed:alerting.rules:writer`
`fixed:alerting.instances:writer`
`fixed:alerting.notifications:writer` | Add, update, and delete alert rules, silences, contact points, and notification policies in Grafana and external providers. |
-| Full read-only access: `fixed:alerting:reader` | All permissions from `fixed:alerting.rules:reader`
`fixed:alerting.instances:reader`
`fixed:alerting.notifications:reader` | Read alert rules, alert instances, silences, contact points, and notification policies in Grafana and external providers. |
-| Read via Provisioning API + Export Secrets: `fixed:alerting.provisioning.secrets:reader` | `alert.provisioning:read` and `alert.provisioning.secrets:read` | Read alert rules, alert instances, silences, contact points, and notification policies using the provisioning API and use export with decrypted secrets. |
-| Access to alert rules provisioning API: `fixed:alerting.provisioning:writer` | `alert.provisioning:read` and `alert.provisioning:write` | Manage all alert rules, notification policies, contact points, templates, in the organization using the provisioning API. |
-| Set provisioning status: `fixed:alerting.provisioning.status:writer` | `alert.provisioning.provenance:write` | Set provisioning rules for Alerting resources. Should be used together with other regular roles (Notifications Writer and/or Rules Writer.) |
+| Display name in UI / Fixed role | Permissions | Description |
+| ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Silences Writer: `fixed:alerting.instances:writer` | All permissions from `fixed:alerting.instances:reader` and
`alert.instances:create`
`alert.instances:write` for organization scope
`alert.instances.external:write` for scope `datasources:*` | Add and update silences in Grafana and external providers. |
+| Instances and Silences Reader: `fixed:alerting.instances:reader` | `alert.instances:read` for organization scope
`alert.instances.external:read` for scope `datasources:*` | Read alert instances and silences in Grafana and external providers. |
+| Notifications Writer: `fixed:alerting.notifications:writer` | All permissions from `fixed:alerting.routes:writer`,
`fixed:alerting.receivers:creator`,
`fixed:alerting.receivers:writer`,
`fixed:alerting.templates:writer`,
`fixed:alerting.time-intervals:writer`and
`alert.notifications:write`for organization scope
`alert.notifications.external:read` for scope `datasources:*` | Add, update, and delete notification policies and contact points in Grafana and external providers. |
+| Notifications Reader: `fixed:alerting.notifications:reader` | All permissions from `fixed:alerting.routes:reader`,
`fixed:alerting.receivers:reader`,
`fixed:alerting.templates:reader`,
`fixed:alerting.time-intervals:reader`and
`alert.notifications:read` for organization scope
`alert.notifications.external:read` for scope `datasources:*` | Read notification policies and contact points in Grafana and external providers. |
+| Rules Writer: `fixed:alerting.rules:writer` | All permissions from `fixed:alerting.rules:reader` and
`alert.rule:create`
`alert.rule:write`
`alert.rule:delete`
`alert.silences:create`
`alert.silences:write` for scope `folders:*`
`alert.rules.external:write` for scope `datasources:*` | Create, update, and delete all alert rules and manage rule-specific silences. |
+| Rules Reader: `fixed:alerting.rules:reader` | `alert.rule:read`, `alert.silences:read` for scope `folders:*`
`alert.rules.external:read` for scope `datasources:*`
`alert.notifications.time-intervals:read`
`alert.notifications.receivers:list` | Read all alert rules and rule-specific silences in Grafana and external providers. |
+| Full access: `fixed:alerting:writer` | All permissions from `fixed:alerting.rules:writer`
`fixed:alerting.instances:writer`
`fixed:alerting.notifications:writer` | Add, update, and delete alert rules, silences, contact points, and notification policies in Grafana and external providers. |
+| Full read-only access: `fixed:alerting:reader` | All permissions from `fixed:alerting.rules:reader`
`fixed:alerting.instances:reader`
`fixed:alerting.notifications:reader` | Read alert rules, alert instances, silences, contact points, and notification policies in Grafana and external providers. |
+| Read via Provisioning API + Export Secrets: `fixed:alerting.provisioning.secrets:reader` | `alert.provisioning:read` and `alert.provisioning.secrets:read` | Read alert rules, alert instances, silences, contact points, and notification policies using the provisioning API and use export with decrypted secrets. |
+| Access to alert rules provisioning API: `fixed:alerting.provisioning:writer` | `alert.provisioning:read` and `alert.provisioning:write` | Manage all alert rules, notification policies, contact points, templates, in the organization using the provisioning API. |
+| Set provisioning status: `fixed:alerting.provisioning.status:writer` | `alert.provisioning.provenance:write` | Set provisioning rules for Alerting resources. Should be used together with other regular roles (Notifications Writer and/or Rules Writer.) |
If you have enabled the `alertingApiServer` feature toggle, an additional set of fixed roles is available.
@@ -68,6 +68,8 @@ If you have enabled the `alertingApiServer` feature toggle, an additional set of
| Templates Writer: `fixed:alerting.templates:writer` | `alert.notifications.templates:read`, `alert.notifications.templates:write`, `alert.notifications.templates:delete` | Create new and manage existing notification templates. |
| Time Intervals Reader: `fixed:alerting.time-intervals:reader` | `alert.notifications.time-intervals:read` | Read all time intervals. |
| Time Intervals Writer: `fixed:alerting.time-intervals:writer` | `alert.notifications.time-intervals:read`, `alert.notifications.time-intervals:write`, `alert.notifications.time-intervals:delete` | Create new and manage existing time intervals. |
+| Notification Policies Reader: `fixed:alerting.routes:reader` | `alert.notifications.routes:read` | Read all time intervals. |
+| Notification Policies Writer: `fixed:alerting.routes:writer` | `alert.notifications.routes:read` `alert.notifications.routes:write` | Create new and manage existing time intervals. |
## Create custom roles