A role determines what a user can see and do once they're logged in. Getting this right means people have exactly enough access to do their job — no more, no less.
Common role levels
- Viewer — read-only access to dashboards and reports. A good default for stakeholders and management who need visibility but never configure anything.
- Operator — can acknowledge and respond to alerts, and typically work with checks and hosts day to day, without access to system-wide administrative settings.
- Administrator — full access, including Users, System Configuration, and Integrations. Reserve this for the small number of people who actually manage the platform itself.
The exact set of roles and what each one permits can vary by deployment, so treat the above as a starting framework rather than a fixed list — the important part is that the levels exist and are actually used, not that they match these names exactly.
Assigning and changing a role
Set a user's role when creating their account under Administration, then Users, and revisit it any time their responsibilities change — a common gap is someone who moved teams keeping access to systems they no longer work with.
Dashboard-level sharing
Beyond the platform-wide role, individual custom dashboards (see Custom Dashboards) can often be shared with specific control over who can edit versus only view — useful when a dashboard needs to be visible broadly but only maintained by one team.
Keep access reviewed
Least privilege is easiest to maintain by habit: default new users to Viewer or Operator rather than Administrator, and periodically review who actually holds administrative access. It's far easier to grant more access when someone needs it than to notice, months later, that access nobody remembers granting is still sitting there.