Roles and permissions

These are the built-in roles for the Observability service. Each row lists a role, what it grants, and the exact permissions it includes. Roles are system-defined (built-in) or custom; permissions are system-defined and read-only. The platform-wide Viewer, Editor, and Admin roles also apply across every service; see the roles and permissions catalogue. You can also compose a custom role from any of these permissions.

Two Observability specifics are worth knowing:

There is no ingest permission. Workloads push telemetry through the collection pipeline, never through an API call, so no permission governs raw ingestion. Permissions cover reading telemetry and managing the configuration around it.
Quota-limit changes are admin-only. The editor tier can read quota definitions and limits but cannot create or update a limit, so an editor cannot raise the query quotas of their own workspace.

An organisation-wide query (the - workspace wildcard) additionally requires the relevant query permission granted at organisation scope.

Observability ships the service-level trio today; per-resource roles follow the same matrix as the other services and are planned.

Role	Included permissions
Observability Viewer Read-only access to all observability resources	`observability.activity.get` `observability.activity.list` `observability.alertrule.get` `observability.alertrule.list` `observability.ingestionconfig.get` `observability.ingestionconfig.list` `observability.log.query` `observability.log.tail` `observability.logsink.get` `observability.logsink.list` `observability.metric.query` `observability.operation.get` `observability.operation.list` `observability.quotadefinition.get` `observability.quotadefinition.list` `observability.quotalimit.get` `observability.quotalimit.list` `observability.retentionpolicy.get` `observability.retentionpolicy.list` `observability.silence.get` `observability.silence.list` `observability.trace.query`
Observability Editor Read/write access to all observability resources	`observability.activity.get` `observability.activity.list` `observability.alertrule.create` `observability.alertrule.get` `observability.alertrule.list` `observability.alertrule.update` `observability.ingestionconfig.create` `observability.ingestionconfig.get` `observability.ingestionconfig.list` `observability.ingestionconfig.update` `observability.log.query` `observability.log.tail` `observability.logsink.create` `observability.logsink.get` `observability.logsink.list` `observability.logsink.update` `observability.metric.query` `observability.operation.get` `observability.operation.list` `observability.quotadefinition.get` `observability.quotadefinition.list` `observability.quotalimit.get` `observability.quotalimit.list` `observability.retentionpolicy.create` `observability.retentionpolicy.get` `observability.retentionpolicy.list` `observability.retentionpolicy.update` `observability.silence.create` `observability.silence.get` `observability.silence.list` `observability.trace.query`
Observability Admin Full access to all observability resources	`observability.activity.get` `observability.activity.list` `observability.alertrule.create` `observability.alertrule.delete` `observability.alertrule.get` `observability.alertrule.list` `observability.alertrule.update` `observability.ingestionconfig.create` `observability.ingestionconfig.get` `observability.ingestionconfig.list` `observability.ingestionconfig.update` `observability.log.query` `observability.log.tail` `observability.logsink.create` `observability.logsink.delete` `observability.logsink.get` `observability.logsink.list` `observability.logsink.update` `observability.metric.query` `observability.operation.get` `observability.operation.list` `observability.quotadefinition.get` `observability.quotadefinition.list` `observability.quotalimit.create` `observability.quotalimit.delete` `observability.quotalimit.get` `observability.quotalimit.list` `observability.quotalimit.update` `observability.retentionpolicy.create` `observability.retentionpolicy.get` `observability.retentionpolicy.list` `observability.retentionpolicy.update` `observability.silence.create` `observability.silence.delete` `observability.silence.get` `observability.silence.list` `observability.trace.query`

Roles and permissions

Related