Dashboard visibility does not define every query a user can make
A dashboard is a saved presentation of queries. Restricting access to its folder controls who can view or edit that presentation. It does not automatically prove that the same user cannot query the underlying data through another supported Grafana interface.
Grafana's documented default organization behavior allows users, including Viewers, to query organization data sources. Fine-grained data-source permissions are available in Grafana Enterprise and Grafana Cloud. A design that assumes those controls exist in every edition can leave the intended tenant boundary unenforced.
Setup: map identity to the actual backend authority
Record the Grafana edition, organization membership, basic or custom roles and available access-control features. Inventory each data source, its backend identity and the data that identity can read. A broadly privileged backend credential is significant even if a dashboard displays only a narrow query.
For tenant or customer separation, define the boundary explicitly. Supported data-source permissions can control who queries a source, while backend authorization or supported label-based controls may be needed to restrict records within it. Separate organizations, stacks or narrowly scoped credentials can be appropriate depending on the product and operating model.
Review the access path
- Enumerate relevant users, teams and service accounts. Check direct grants as well as permissions inherited through basic roles or team membership.
- Compare folder access with the ability to query each data source. Use a dedicated test account representing the intended reader, not an administrator whose broad access masks missing restrictions.
- Review the backend credential outside user-facing dashboards. Determine whether it can read multiple tenant datasets and whether backend authorization constrains requests independently of the saved query text.
- Where the edition supports data-source permissions, configure the required Query, Edit or Admin capabilities deliberately. Remove broad defaults only after testing the approved users and service accounts that need to continue operating.
Illustrative incident: a restricted folder conceals a broad credential
In this illustrative example, two customer dashboards sit in separate folders. Both query a source whose credential can read both customers' telemetry. A viewer cannot open the other folder, but the organization still permits that viewer to issue queries to the shared source.
The team tests the actual query permission and revises the data-access design using supported controls and narrower backend authority. It validates both permitted and forbidden tenant queries. The scenario explains authorization layering and does not claim a real data exposure.
Diagnostic table
| Observation | Evidence | Boundary to review |
|---|---|---|
| Folder is hidden but queries succeed | Test-user query capability | Data-source authorization |
| One credential reads many tenants | Backend role and dataset scope | Shared backend authority |
| Permissions tab is unavailable | Edition and license capabilities | Feature availability |
| Automation stops after access changes | Service-account grants | Nonhuman query identity |
Verification and change acceptance
Create an access matrix covering dashboard view, query, data-source edit and administrative actions. Test it with representative identities and a controlled dataset. Include direct backend access if users or tools possess separate credentials; Grafana settings cannot revoke an independent access path.
Check that scheduled alerts and reporting still use their intended service identities. Preserve a recovery administrator path and version the approved permissions. Successful dashboard loading proves one allowed journey; an authorization review also needs evidence that disallowed queries fail.
Security SOP
Assign an owner to each source and backend identity. Review team membership, service accounts and credential scopes during onboarding and offboarding. Keep the edition assumptions beside the architecture decision. Reassess tenant boundaries when changing telemetry backends or enabling new query interfaces, rather than relying on folder organization as the entire security model.
See Clouvenix cloud security for implementation and operational handover.
Technical reference
Official reference 1; Official reference 2. Documentation checked 19 October 2026; confirm behavior for your deployed edition and version.