Folder Permissions

Overview

Folders are the primary mechanism for organizing and controlling access to Kloudfuse content. When a permission is assigned to a folder, it applies to everything inside it — dashboards, alerts, sub-folders, and all other objects contained within.

Permissions can be granted to four types of principals:

Users

Human accounts authenticated through the login page or an SSO provider. Permissions can be assigned directly to a specific user, granting that individual access to the folder and its contents.

Teams

Groups of users. Assigning a team to a folder grants access to all current and future team members simultaneously. Teams are the recommended approach for managing shared folder access at scale.

Roles

System-wide roles (Admin, Editor, or Viewer). Assigning a role to a folder grants access to every user who holds that role. Each role receives default folder permissions that can be adjusted on a per-folder basis.

Service Accounts

Non-human identities used for API access and system integrations. Service Accounts can be granted folder permissions independently of team membership, allowing automated pipelines to access specific content.

A user’s effective permission level on a folder is the highest level granted across all of their applicable permission sources.

Folder managed objects

The following Kloudfuse objects are governed by folder-level permissions:

Object Description

Dashboards

Visualization panels and charts that display metrics, logs, traces, and other telemetry data.

Alert rules

Threshold and anomaly detection rules across all signal types — Metrics, Events, Logs, Traces, APM, SLO, and RUM.

Sub-folders

Nested folders used to further organize content within a parent folder. Sub-folders inherit the parent folder’s permissions.

Scheduled Views

Pre-computed log views that run on a schedule to improve query performance over large datasets.

Saved Queries

Reusable query definitions that can be shared across dashboards and explorers.

Lookup Tables

Reference data tables used to enrich telemetry streams with additional context during query time.

Favorite Facets

User-defined field groupings that appear as quick-filter options in the log and trace explorers.

Scheduled Searches

Saved searches configured to run automatically and deliver results on a defined schedule.
Creating objects at the root level (outside any folder) only requires the user to hold an Admin or Editor account role. Root-level objects are not subject to folder permissions.

Permission Levels

Level What it grants

View

Read-only access. Users can view the folder and its contents but cannot create, edit, or delete any objects.

Edit

Full create, edit, and delete access for all objects within the folder. Editors can also create sub-folders.

Admin

All Edit capabilities, plus the ability to manage the folder’s own permissions — adding, changing, and removing access for users, teams, and roles.

No Access

Completely hides the folder from the user. The folder will not appear in dropdowns or listings. Use this to restrict a role that would otherwise inherit access through a default role assignment.

Permission Inheritance

Permissions flow downward through the folder hierarchy. A user who has Edit access on a parent folder automatically has at least Edit access on all sub-folders within it. A sub-folder’s effective permission level for a user cannot fall below what they inherit from a parent folder, but additional permissions can be granted to specific users, teams, or roles on the sub-folder.

Admin users always have full access to all folders, regardless of folder-level permission assignments.

View Folder Permissions

  1. In the sidebar, click Admin in the lower left corner and navigate to the Folders option.

  2. In the Folders table, click the name of the folder you want to manage.

  3. A permissions sidebar appears on the right, listing all current assignments for that folder by role, team, user, and service account.

Update a Role Permission

Every role is assigned a default permission level for every folder:

  • Admin — Admin access

  • Editor — Edit access

  • Viewer — View access

To prevent all users with a given role from accessing a folder, change that role’s permission to No Access. Users then need an explicit team, user, or service account assignment to access the folder.

Update User, Team, or Service Account Access

Users, Teams, and Service Accounts can all be granted additional permissions beyond what is inherited from their Role. Select a specific User, Team, or Service Account and assign them Admin, Edit, or View access.

Troubleshooting

Cannot Change Admin Role

The option to change the Admin Role is greyed-out because it will always have Admin access to a folder and cannot be changed.

Cannot Create a Folder

Only users with an Admin or Editor account role can create folders under the root. If the New folder option is unavailable, check that the user’s account role is Editor or Admin.

To create a sub-folder inside an existing folder, the user must have Edit or Admin permission on that parent folder.

Cannot Create or Edit an object in a Folder

To create or modify objects in a folder, a user needs Edit or Admin permission from at least one permission source (a direct user assignment, a team membership, or a role-based assignment). Check all three sources in the Manage permissions panel.

Folder Is Greyed Out in the Dropdown

A greyed-out folder in a dropdown means the user has View permission only across all applicable sources. Grant Edit or Admin permission through a user, team, or role assignment.