Skip to main content
Resource types in Metoro represent the different categories of resources that can be accessed and managed. Each resource type has its own set of permissions that can be granted through roles. For how roles, groups, and permissions fit together, see Access Control (RBAC).

​
Available Resource Types

Create role dialog with resource type permissions

​
Access Management

  • Resource Type: accessManagement
  • Description: Controls user and role management capabilities
  • Permissions:
    • create - Create new users and roles
    • read - View users and roles
    • update - Modify existing users and roles
    • delete - Remove users and roles

​
Alerts

  • Resource Type: alerts
  • Description: Controls access to alert configurations and management
  • Permissions:
    • create - Create new alerts
    • read - View existing alerts
    • update - Modify alert configurations
    • delete - Remove alerts

​
Billing

  • Resource Type: billing
  • Description: Controls access to billing and subscription management
  • Permissions:
    • create - Create new billing configurations
    • read - View billing information and usage
    • update - Modify billing settings
    • delete - Remove billing configurations

​
Dashboards

  • Resource Type: dashboards
  • Description: Controls access to dashboard creation and management
  • Permissions:
    • create - Create new dashboards
    • read - View dashboards
    • update - Modify dashboard configurations
    • delete - Remove dashboards

​
Environments

  • Resource Type: environments
  • Description: Controls access to adding a new environment/cluster to Metoro or deleting the existing ones
  • Permissions:
    • create - Create (ie. Add) new environments/clusters to Metoro
    • delete - Remove environments
    • Note: Read access is available to all users, and update operations are not applicable

​
Investigations

  • Resource Type: investigations
  • Description: Controls access to AI investigations and all Guardian AI output. This includes investigations, AI issues, agent runs, and organization-wide Guardian conversations.
  • Permissions:
    • create - Create investigations, trigger Guardian investigations, and create AI issues
    • read - View investigations, AI issues, agent runs, the organization-wide conversation history, and other users’ Guardian conversations
    • update - Modify investigations and AI issues, and continue or stop another user’s (or an agent’s) Guardian conversation
    • delete - Remove investigations and AI issues
  • Note: every user can always chat privately with Guardian and see their own conversations, regardless of this permission. Conversations are only visible to their owner unless the viewer has read on investigations.

​
Integrations

  • Resource Type: integrations
  • Description: Controls access to integration settings and configurations, excluding webhook endpoints
  • Permissions:
    • create - Add new integrations
    • read - View integration settings
    • update - Modify integration settings
    • delete - Remove integrations

​
Webhooks

  • Resource Type: webhooks
  • Description: Controls access to webhook endpoints used as alert destinations. Webhooks are filesystem-backed, so permissions can be scoped to folders such as /webhooks/default/*, /webhooks/team-a/*, or Kubernetes-managed paths like /webhooks/kubernetes-managed/prod/payments/*.
  • Permissions:
    • create - Add new webhook endpoints
    • read - View webhook endpoints
    • update - Modify webhook endpoints
    • delete - Remove webhook endpoints

​
Log Filters

  • Resource Type: logFilters
  • Description: Controls access to log filter configurations
  • Permissions:
    • create - Create new log filters
    • read - View log filters
    • update - Modify log filter settings
    • delete - Remove log filters

​
Trace Redaction Rules

  • Resource Type: traceRedacts
  • Description: Controls access to trace redaction rule configurations
  • Permissions:
    • create - Create new redaction rules
    • read - View redaction rules
    • update - Modify redaction rules
    • delete - Remove redaction rules

​
Workflows

  • Resource Type: workflows
  • Description: Controls access to issues and workflows
  • Permissions:
    • create - Create new workflows
    • read - View workflows and issues created by the workflows
    • update - Modify workflow and issues configurations
    • delete - Remove workflows

​
Permission Scope

For most resource types, granting a permission covers every resource of that type: a role with read on integrations can view all integrations in the organization. Filesystem-backed resource types — alerts, dashboards, and webhooks — are the exception. Permissions on them are scoped to a folder path (such as /alerts/default/team-a/*), so a role can grant access to one team’s folder without exposing the rest. See path scoping for how paths and verbs interact.

​
Best Practices

  1. Principle of Least Privilege
    • Grant only the permissions necessary for users to perform their tasks
    • Regularly review and audit role permissions
    • Consider starting with read-only access and adding other permissions as needed
  2. Role Organization
    • Create roles based on job functions or responsibilities
    • Use descriptive names for custom roles
    • Document the purpose and scope of each custom role
  3. Permission Management
    • Regularly audit user roles and permissions
    • Remove unnecessary permissions promptly
    • Use custom roles for fine-grained access control