Announcing Role Based Access Control in ClickStack

Summary

Managed ClickStack has introduced Role-Based Access Control (RBAC) to replace a legacy model where all users shared identical instance-wide permissions or required duplicate HyperDX instances for isolation. Integrated with ClickHouse Cloud for identity management, the new system allows administrators to assign users to roles governed by three access tiers: no access, read, and manage. Permissions apply across platform resources including dashboards, saved searches, sources, alerts, webhooks, and notebooks, with support for fine-grained rules matching names, IDs, or tags. While table-level source restrictions work through ClickStack, row-level access currently depends on separate ClickHouse SQL console roles, which the team intends to unify directly inside ClickStack in future releases.

Takeaways

1. 1

   ClickStack RBAC assigns three distinct access levels—no access, read, and manage—across dashboards, saved searches, sources, alerts, webhooks, and notebooks.

2. 2

   Fine-grained access rules allow roles to evaluate multiple independent conditions targeting resource attributes such as names, IDs, or tags.

3. 3

   Users are authenticated via ClickHouse Cloud requiring at least SQL console read-only access, while full administrative features such as alerts require SQL console admin access.