---
title: 'RBAC role definitions'
menuTitle: 'RBAC role definitions'
description: 'This topic includes a table that lists permission associated with Grafana fixed and basic roles.'
aliases: ['/docs/grafana/latest/enterprise/access-control/fine-grained-access-control-references/']
weight: 70
---

# RBAC role definitions

The following tables list permissions associated with basic and fixed roles.

## Basic role assignments

| Basic role    | Associated fixed roles                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Description                                                                                                                                                                                     |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Grafana Admin | `fixed:roles:reader`<br>`fixed:roles:writer`<br>`fixed:users:reader`<br>`fixed:users:writer`<br>`fixed:org.users:reader`<br>`fixed:org.users:writer`<br>`fixed:ldap:reader`<br>`fixed:ldap:writer`<br>`fixed:stats:reader`<br>`fixed:settings:reader`<br>`fixed:settings:writer`<br>`fixed:provisioning:writer`<br>`fixed:organization:reader`<br>`fixed:organization:maintainer`<br>`fixed:licensing:reader`<br>`fixed:licensing:writer`                                                                                                                                                                          | Default [Grafana server administrator]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#grafana-server-administrators" >}}) assignments.            |
| Admin         | `fixed:reports:reader`<br>`fixed:reports:writer`<br>`fixed:datasources:reader`<br>`fixed:datasources:writer`<br>`fixed:organization:writer`<br>`fixed:datasources.permissions:reader`<br>`fixed:datasources.permissions:writer`<br>`fixed:teams:writer`<br>`fixed:dashboards:reader`<br>`fixed:dashboards:writer`<br>`fixed:dashboards.permissions:reader`<br>`fixed:dashboards.permissions:writer`<br>`fixed:folders:reader`<br>`fixes:folders:writer`<br>`fixed:folders.permissions:reader`<br>`fixed:folders.permissions:writer`<br>`fixed:alerting:editor`<br>`fixed:apikeys:reader`<br>`fixed:apikeys:writer` | Default [Grafana organization administrator]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#organization-users-and-permissions" >}}) assignments. |
| Editor        | `fixed:datasources:explorer`<br>`fixed:dashboards:creator`<br>`fixed:folders:creator`<br>`fixed:annotations:writer`<br>`fixed:teams:creator` if the `editors_can_admin` configuration flag is enabled<br>`fixed:alerting:editor`                                                                                                                                                                                                                                                                                                                                                                                   | Default [Editor]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#organization-users-and-permissions" >}}) assignments.                             |
| Viewer        | `fixed:datasources:id:reader`<br>`fixed:organization:reader`<br>`fixed:annotations:reader`<br>`fixed:annotations.dashboard:writer`<br>`fixed:alerting:reader`                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Default [Viewer]({{< relref "../../administration/manage-users-and-permissions/about-users-and-permissions.md#organization-users-and-permissions" >}}) assignments.                             |

## Fixed role definitions

| Fixed role                             | Permissions                                                                                                                                                                                                                                                              | Description                                                                                                                                                                                                                                                                           |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `fixed:alerting.instances:editor`      | All permissions from `fixed:alerting.instances:reader` and<br> `alert.instances:create`<br>`alert.instances:update` for organization scope <br> `alert.instances.external:write` for scope `datasources:*`                                                               | Create, update and expire all silences in the organization produced by Grafana, Mimir, and Loki.[\*](#alerting-roles)                                                                                                                                                                 |
| `fixed:alerting.instances:reader`      | `alert.instances:read` for organization scope <br> `alert.instances.external:read` for scope `datasources:*`                                                                                                                                                             | Read all alerts and silences in the organization produced by Grafana Alerts and Mimir and Loki alerts and silences.[\*](#alerting-roles)                                                                                                                                              |
| `fixed:alerting.notifications:editor`  | All permissions from `fixed:alerting.notifications:reader` and<br>`alert.notifications:create`<br>`alert.notifications:update`<br>`alert.notifications:delete` for organization scope<br>`alert.notifications.external:read` for scope `datasources:*`                   | Create, update, and delete contact points, templates, mute timings and notification policies for Grafana and external Alertmanager.[\*](#alerting-roles)                                                                                                                              |
| `fixed:alerting.notifications:reader`  | `alert.notifications:read` for organization scope<br>`alert.notifications.external:read` for scope `datasources:*`                                                                                                                                                       | Read all Grafana and Alertmanager contact points, templates, and notification policies.[\*](#alerting-roles)                                                                                                                                                                          |
| `fixed:alerting.rules:editor`          | All permissions from `fixed:alerting.rules:reader` and <br> `alert.rule:create` <br> `alert.rule:update` <br> `alert.rule:delete` for scope `folders:*` <br> `alert.rules.external:write` for scope `datasources:*`                                                      | Create, update, and delete all\* Grafana, Mimir, and Loki alert rules.[\*](#alerting-roles)                                                                                                                                                                                           |
| `fixed:alerting.rules:reader`          | `alert.rule:read` for scope `folders:*` <br> `alert.rules.external:read` for scope `datasources:*`                                                                                                                                                                       | Read all\* Grafana, Mimir, and Loki alert rules.[\*](#alerting-roles)                                                                                                                                                                                                                 |
| `fixed:alerting:editor`                | All permissions from `fixed:alerting.rules:editor` <br>`fixed:alerting.instances:editor`<br>`fixed:alerting.notifications:editor`                                                                                                                                        | Create, update, and delete Grafana, Mimir, Loki and Alertmanager alert rules\*, silences, contact points, templates, mute timings, and notification policies.[\*](#alerting-roles)                                                                                                    |
| `fixed:alerting:reader`                | All permissions from `fixed:alerting.rules:reader` <br>`fixed:alerting.instances:reader`<br>`fixed:alerting.notifications:reader`                                                                                                                                        | Read-only permissions for all Grafana, Mimir, Loki and Alertmanager alert rules\*, alerts, contact points, and notification policies.[\*](#alerting-roles)                                                                                                                            |
| `fixed:annotations.dashboard:writer`   | `annotations:write` <br>`annotations.create`<br> `annotations:delete` for scope `annotations:type:dashboard`                                                                                                                                                             | Create, update and delete dashboard annotations and annotation tags.                                                                                                                                                                                                                  |
| `fixed:annotations:reader`             | `annotations:read` for scopes `annotations:type:*`                                                                                                                                                                                                                       | Read all annotations and annotation tags.                                                                                                                                                                                                                                             |
| `fixed:annotations:writer`             | All permissions from `fixed:annotations:reader` <br>`annotations:write` <br>`annotations.create`<br> `annotations:delete` for scope `annotations:type:*`                                                                                                                 | Read, create, update and delete all annotations and annotation tags.                                                                                                                                                                                                                  |
| `fixed:apikeys:reader`                 | `apikeys:read` for scope `apikeys:*`                                                                                                                                                                                                                                     | Read all api keys.                                                                                                                                                                                                                                                                    |
| `fixed:apikeys:writer`                 | All permissions from `fixed:apikeys:reader` and <br> `apikeys:create` <br> `apikeys:delete` for scope `apikeys:*`                                                                                                                                                        | Read, create, delete all api keys.                                                                                                                                                                                                                                                    |
| `fixed:dashboards.permissions:reader`  | `dashboards.permissions:read`                                                                                                                                                                                                                                            | Read all dashboard permissions.                                                                                                                                                                                                                                                       |
| `fixed:dashboards.permissions:writer`  | All permissions from `fixed:dashboards.permissions:reader` and <br>`dashboards.permissions:write`                                                                                                                                                                        | Read and update all dashboard permissions.                                                                                                                                                                                                                                            |
| `fixed:dashboards:creator`             | `dashboards:create`<br>`folders:read`                                                                                                                                                                                                                                    | Create dashboards.                                                                                                                                                                                                                                                                    |
| `fixed:dashboards:reader`              | `dashboards:read`                                                                                                                                                                                                                                                        | Read all dashboards.                                                                                                                                                                                                                                                                  |
| `fixed:dashboards:writer`              | All permissions from `fixed:dashboards:reader` and <br>`dashboards:write`<br>`dashboards:edit`<br>`dashboards:delete`<br>`dashboards:create`<br>`dashboards.permissions:read`<br>`dashboards.permissions:write`                                                          | Read, create, update, and delete all dashboards.                                                                                                                                                                                                                                      |
| `fixed:datasources.permissions:reader` | `datasources.permissions:read`                                                                                                                                                                                                                                           | Read data source permissions.                                                                                                                                                                                                                                                         |
| `fixed:datasources.permissions:writer` | All permissions from `fixed:datasources.permissions:reader` and <br>`datasources.permissions:write`                                                                                                                                                                      | Create, read, or delete permissions of a data source.                                                                                                                                                                                                                                 |
| `fixed:datasources:explorer`           | `datasources:explore`                                                                                                                                                                                                                                                    | Enable the Explore feature. Data source permissions still apply, you can only query data sources for which you have query permissions.                                                                                                                                                |
| `fixed:datasources:id:reader`          | `datasources.id:read`                                                                                                                                                                                                                                                    | Read the ID of a data source based on its name.                                                                                                                                                                                                                                       |
| `fixed:datasources:reader`             | `datasources:read`<br>`datasources:query`                                                                                                                                                                                                                                | Read and query data sources.                                                                                                                                                                                                                                                          |
| `fixed:datasources:writer`             | All permissions from `fixed:datasources:reader` and <br>`datasources:create`<br>`datasources:write`<br>`datasources:delete`                                                                                                                                              | Read, query, create, delete, or update a data source.                                                                                                                                                                                                                                 |
| `fixed:folders.permissions:reader`     | `folders.permissions:read`                                                                                                                                                                                                                                               | Read all folder permissions.                                                                                                                                                                                                                                                          |
| `fixed:folders.permissions:writer`     | All permissions from `fixed:folders.permissions:reader` and <br>`folders.permissions:write`                                                                                                                                                                              | Read and update all folder permissions.                                                                                                                                                                                                                                               |
| `fixed:folders:creator`                | `folders:create`                                                                                                                                                                                                                                                         | Create folders.                                                                                                                                                                                                                                                                       |
| `fixed:folders:reader`                 | `folders:read`<br>`dashboards:read`                                                                                                                                                                                                                                      | Read all folders and dashboards.                                                                                                                                                                                                                                                      |
| `fixed:folders:writer`                 | All permissions from `fixed:dashboards:writer` and <br>`folders:read`<br>`folders:write`<br>`folders:create`<br>`folders:delete`<br>`folders.permissions:read`<br>`folders.permissions:write`                                                                            | Read, create, update, and delete all folders and dashboards.                                                                                                                                                                                                                          |
| `fixed:ldap:reader`                    | `ldap.user:read`<br>`ldap.status:read`                                                                                                                                                                                                                                   | Read the LDAP configuration and LDAP status information.                                                                                                                                                                                                                              |
| `fixed:ldap:writer`                    | All permissions from `fixed:ldap:reader` and <br>`ldap.user:sync`<br>`ldap.config:reload`                                                                                                                                                                                | Read and update the LDAP configuration, and read LDAP status information.                                                                                                                                                                                                             |
| `fixed:licensing:reader`               | `licensing:read`<br>`licensing.reports:read`                                                                                                                                                                                                                             | Read licensing information and licensing reports.                                                                                                                                                                                                                                     |
| `fixed:licensing:writer`               | All permissions from `fixed:licensing:viewer` and <br>`licensing:update`<br>`licensing:delete`                                                                                                                                                                           | Read licensing information and licensing reports, update and delete the license token.                                                                                                                                                                                                |
| `fixed:org.users:reader`               | `org.users:read`                                                                                                                                                                                                                                                         | Read users within a single organization.                                                                                                                                                                                                                                              |
| `fixed:org.users:writer`               | All permissions from `fixed:org.users:reader` and <br>`org.users:add`<br>`org.users:remove`<br>`org.users.role:update`                                                                                                                                                   | Within a single organization, add a user, invite a user, read information about a user and their role, remove a user from that organization, or change the role of a user.                                                                                                            |
| `fixed:organization:maintainer`        | All permissions from `fixed:organization:reader` and <br> `orgs:write`<br>`orgs:create`<br>`orgs:delete`<br>`orgs.quotas:write`                                                                                                                                          | Create, read, write, or delete an organization. Read or write its quotas. This role needs to be assigned globally.                                                                                                                                                                    |
| `fixed:organization:reader`            | `orgs:read`<br>`orgs.quotas:read`                                                                                                                                                                                                                                        | Read an organization and its quotas.                                                                                                                                                                                                                                                  |
| `fixed:organization:writer`            | All permissions from `fixed:organization:reader` and <br> `orgs:write`<br>`orgs.preferences:read`<br>`orgs.preferences:write`                                                                                                                                            | Read an organization, its quotas, or its preferences. Update organization properties, or its preferences.                                                                                                                                                                             |
| `fixed:provisioning:writer`            | `provisioning:reload`                                                                                                                                                                                                                                                    | Reload provisioning.                                                                                                                                                                                                                                                                  |
| `fixed:reports:reader`                 | `reports:read`<br>`reports:send`<br>`reports.settings:read`                                                                                                                                                                                                              | Read all reports and shared report settings.                                                                                                                                                                                                                                          |
| `fixed:reports:writer`                 | All permissions from `fixed:reports:reader` and <br>`reports.admin:write`<br>`reports:delete`<br>`reports.settings:write`                                                                                                                                                | Create, read, update, or delete all reports and shared report settings.                                                                                                                                                                                                               |
| `fixed:roles:reader`                   | `roles:read`<br>`roles:list`<br>`teams.roles:list`<br>`users.roles:list`<br>`users.permissions:list`                                                                                                                                                                     | Read all access control roles, roles and permissions assigned to users, teams.                                                                                                                                                                                                        |
| `fixed:roles:writer`                   | All permissions from `fixed:roles:reader` and <br>`roles:write`<br>`roles:delete`<br>`teams.roles:add`<br>`teams.roles:remove`<br>`users.roles:add`<br>`users.roles:remove`                                                                                              | Create, read, update, or delete all roles, assign or unassign roles to users, teams.                                                                                                                                                                                                  |
| `fixed:roles:resetter`                 | `roles:write` with scope `permissions:type:escalate`                                                                                                                                                                                                                     | Reset basic roles to their default.                                                                                                                                                                                                                                                   |
| `fixed:settings:reader`                | `settings:read`                                                                                                                                                                                                                                                          | Read Grafana instance settings.                                                                                                                                                                                                                                                       |
| `fixed:settings:writer`                | All permissions from `fixed:settings:reader` and<br>`settings:write`                                                                                                                                                                                                     | Read and update Grafana instance settings.                                                                                                                                                                                                                                            |
| `fixed:stats:reader`                   | `server.stats:read`                                                                                                                                                                                                                                                      | Read Grafana instance statistics.                                                                                                                                                                                                                                                     |
| `fixed:teams:creator`                  | `teams:create`<br>`org.users:read`                                                                                                                                                                                                                                       | Create a team and list organization users (required to manage the created team).                                                                                                                                                                                                      |
| `fixed:teams:writer`                   | `teams:create`<br>`teams:delete`<br>`teams:read`<br>`teams:write`<br>`teams.permissions:read`<br>`teams.permissions:write`                                                                                                                                               | Create, read, update and delete teams and manage team memberships.                                                                                                                                                                                                                    |
| `fixed:users:reader`                   | `users:read`<br>`users.quotas:list`<br>`users.authtoken:list`<br>`users.teams:read`                                                                                                                                                                                      | Read all users and their information, such as team memberships, authentication tokens, and quotas.                                                                                                                                                                                    |
| `fixed:users:writer`                   | All permissions from `fixed:users:reader` and <br>`users:write`<br>`users:create`<br>`users:delete`<br>`users:enable`<br>`users:disable`<br>`users.password:update`<br>`users.permissions:update`<br>`users:logout`<br>`users.authtoken:update`<br>`users.quotas:update` | Read and update all attributes and settings for all users in Grafana: update user information, read user information, create or enable or disable a user, make a user a Grafana administrator, sign out a user, update a user’s authentication token, or update quotas for all users. |

### Alerting roles

If alerting is [enabled]({{< relref "../../alerting/opt-in.md" >}}), you can use predefined roles to manage user access to alert rules, alert instances, and alert notification settings and create custom roles to limit user access to alert rules in a folder.

Access to Grafana alert rules is an intersection of many permissions:

- Permission to read a folder. For example, the fixed role `fixed:folders:reader` includes the action `folders:read` and a folder scope `folders:id:`.
- Permission to query **all** data sources that a given alert rule uses. If a user cannot query a given data source, they cannot see any alert rules that query that data source.

For more information about the permissions required to access alert rules, refer to [Create a custom role to access alerts in a folder]({{< relref "./plan-rbac-rollout-strategy#create-a-custom-role-to-access-alerts-in-a-folder" >}}).