Fine-grained access control to Prometheus metrics

Hello,

I am trying to set up grafana in a use case with multiple users, where each one of them should be able to only see data that belongs to them (is labelled with their user id in prometheus).

I used dashboard templating with filtering based on user id.

But this does not work because Grafana creates queries on the client side, so users can manipulate the query freely.

It seems to me that because of this there’s no possibility of data access control within a single prometheus instance.

Is there a way to implement such access control without running separate prometheus instances for each user?

Grafana Enterprise sounds like a possible solution, but I don’t know if it suffers from the same issue.

If it’s not possible in the Grafana ecosystem, do you know of a Grafana alternative that supports that?