Announcing Role Based Access Control in ClickStack

Summary

Managed ClickStack has introduced Role-Based Access Control (RBAC) to replace a legacy model where all users shared identical instance-wide permissions or required duplicate HyperDX instances for isolation. Integrated with ClickHouse Cloud for identity management, the new system allows administrators to assign users to roles governed by three access tiers: no access, read, and manage. Permissions apply across platform resources including dashboards, saved searches, sources, alerts, webhooks, and notebooks, with support for fine-grained rules matching names, IDs, or tags. While table-level source restrictions work through ClickStack, row-level access currently depends on separate ClickHouse SQL console roles, which the team intends to unify directly inside ClickStack in future releases.

Context

Previously, all ClickStack users belonged to a single group with shared permissions, requiring teams to run separate HyperDX instances with duplicated configurations and high operational overhead to segment access.

Approach / What changed

ClickStack introduced RBAC integrated with ClickHouse Cloud user management, enabling role definitions with no access, read, or manage permissions for resources like dashboards and notebooks, alongside fine-grained rules based on resource names, IDs, or tags.

Takeaways

• ClickStack RBAC assigns three distinct access levels—no access, read, and manage—across dashboards, saved searches, sources, alerts, webhooks, and notebooks.
• Fine-grained access rules allow roles to evaluate multiple independent conditions targeting resource attributes such as names, IDs, or tags.
• Users are authenticated via ClickHouse Cloud requiring at least SQL console read-only access, while full administrative features such as alerts require SQL console admin access.

Related reading