docs/sources/administration/roles-and-permissions/folder-access-control/index.md
Folders are the primary way to organize and control access to resources in Grafana. When you assign permissions to a folder, those permissions apply to all resources within that folder, including dashboards, alert rules, SLOs, and more.
This page explains how folder permissions work and how to use them effectively to manage access for teams and users.
{{< admonition type="caution" >}} Folder limitations:
_) or percent signs (%)
{{< /admonition >}}How a folder is created determines its initial permissions:
Folder permissions follow a simple principle: a user's effective access to a resource is determined by their folder permission level.
When you grant a user or team permission on a folder:
Folders support three permission levels. Each level includes all capabilities of the levels below it.
| Permission | Folder capabilities | Resource capabilities |
|---|---|---|
| View | View folder and navigate its contents | View dashboards, read alert rules, read silences, read annotations, read library panels |
| Edit | Create subfolders, modify folder properties | Create and edit dashboards, create and write alert rules, create and write silences, create and write annotations, create and manage library panels |
| Admin | Delete folder, manage folder permissions | All Edit capabilities plus manage dashboard permissions |
View permission grants:
folders:read - View the folder in navigationdashboards:read - View dashboards in the folderalert.rules:read - View alert rules in the folderalert.silences:read - View alert silencesannotations:read - View annotationslibrary.panels:read - View library panelsEdit permission grants (in addition to View):
folders:write - Modify folder name and propertiesfolders:create - Create subfoldersdashboards:create - Create new dashboardsdashboards:write - Edit existing dashboardsdashboards:delete - Delete dashboardsalert.rules:create - Create new alert rulesalert.rules:write - Edit alert rulesalert.rules:delete - Delete alert rulesalert.silences:create - Create silencesalert.silences:write - Edit silencesannotations:create - Create annotationsannotations:write - Edit annotationsannotations:delete - Delete annotationslibrary.panels:create - Create library panelslibrary.panels:write - Edit library panelslibrary.panels:delete - Delete library panelsAdmin permission grants (in addition to Edit):
folders:delete - Delete the folderfolders.permissions:read - View folder permissionsfolders.permissions:write - Modify folder permissionsdashboards.permissions:read - View dashboard permissionsdashboards.permissions:write - Modify dashboard permissionsPermissions cascade from parent folders to child folders. A user with Edit permission on a parent folder automatically has Edit permission on all subfolders.
Production/ # User has Edit permission here
├── Team A Dashboards/ # User inherits Edit permission
│ └── Service Metrics/ # User inherits Edit permission
└── Team B Dashboards/ # User inherits Edit permission
{{< admonition type="note" >}} You cannot grant a user lower permissions on a subfolder than they have on a parent folder. Permission inheritance always flows downward. {{< /admonition >}}
The following resources are stored in folders and respect folder permissions:
| Resource | How folder permissions apply |
|---|---|
| Dashboards | View/Edit/Admin directly controlled by folder permission |
| Subfolders | Inherit parent folder permissions, can add additional permissions |
| Alert rules | View/Edit controlled by folder permission |
| Alert silences | View/Create/Edit controlled by folder permission |
| Library panels | View/Create/Edit/Delete controlled by folder permission |
| SLOs | Folder permission + SLO role determines effective access (refer to Plugin permissions) |
| Annotations | Stored on dashboards; inherit permissions from the dashboard's parent folder |
Some Grafana Cloud plugins use a two-layer permission model where effective access is determined by both folder permissions and a plugin-specific role:
Effective plugin access = minimum(folder permission, plugin role)
For example, with SLOs:
For more information, refer to SLO access control.
Folders are accessed through the Dashboards section in Grafana. You can manage permissions from the folder's context menu or from within the folder view.
The permissions dialog shows all users, teams, and roles with access to this folder.
{{< admonition type="warning" >}} Removing a permission removes access to the folder and all its contents. The user or team will no longer see dashboards, alert rules, or other resources in that folder. {{< /admonition >}}
A well-designed folder structure makes permission management simpler. The recommended pattern is to create top-level folders for each team, with subfolders for organizing content:
SRE Team/ # SRE team has Admin
├── Production Monitoring/ # Inherited Admin
├── On-Call Dashboards/ # Inherited Admin
└── Runbooks/ # Inherited Admin
Platform Team/ # Platform team has Admin
├── Infrastructure/ # Inherited Admin
└── Cost Tracking/ # Inherited Admin
Shared/ # Everyone has View, specific teams have Edit
├── Company KPIs/ # Marketing team has Edit
└── Executive Dashboards/ # Leadership has View
This pattern provides:
For detailed guidance on folder organization patterns, including automation with Terraform and SCIM provisioning, refer to: