Role access
Grant each server to the roles that need it, for example QA only staging and developers only their services.
Who can: Owners, Admins and SREs.
Owners, Admins and SREs always use every server. For everyone else, a server is used only by the roles it's granted to. A new server is granted to nobody.
On the server's page, under Role access, tick Engineering manager, Developer / service owner, QA or Viewer and click Save access.
What a grant controls
- Investigate: the agent only gets tools from servers the asker's role is granted.
- Reports: a report uses the servers its creator's role is granted. A person sees a report's runs only if their role is granted every server the run used.
- Runs: the same rule, so output from a server you can't use never reaches you.
Viewers can't chat or run reports. A grant to Viewers only lets them read report runs built from that server.
Patterns
| Goal | Grant |
|---|---|
| QA tests against staging only | grafana-staging, k8s-staging → QA |
| Developers read their services' repos and logs | github, k8s-dev → Developers |
| Managers follow production health | grafana-prod → Managers |
| Only SREs touch the production database | postgres-prod → nobody (SREs have it already) |
Onboard one server per environment so that grants can follow environments.