Title: Folder Admin users cannot delete Git Sync-managed dashboards without organization Editor role
We are using Git Sync-managed folders with branch protection enabled. Users have the following permissions:
-
Organization role:
Viewer -
Team permission on their Git Sync-managed folder:
Admin
These users can create and edit dashboards in their team folder successfully. Their changes are submitted to Git through the expected pull request workflow.
However, when they select a dashboard and use Delete, the Bulk Delete Provisioned Resources workflow fails while fetching branches and deleting the resource:
repositories.provisioning.grafana.app "git-sync-public-dashboards" is forbidden:
User "<redacted>" cannot create resource "repositories/jobs"
in API group "provisioning.grafana.app" in the namespace "default":
jobs.provisioning.grafana.app is forbidden: editor role is required
Based on the documentation, a Folder Admin should have permission to create, edit, and delete dashboards within that folder. However, bulk deletion creates a Git Sync repository job, which additionally requires provisioning.jobs:create. This permission appears to be granted through the organization-level Editor role rather than the folder-level permission.
This creates an inconsistent experience:
-
Creating and editing dashboards works with
Viewer+ Folder Admin. -
Deleting those same dashboards fails because the user cannot create a provisioning job.
-
Granting the global
Editorrole would also provide broader write access across Grafana, including alerting resources, which we want to avoid.
Could you confirm:
-
Is this behavior expected or a known Git Sync limitation?
-
Should a Folder Admin be able to delete dashboards from their provisioned folder without being an organization Editor?
-
Is there a supported RBAC role or minimal set of permissions we can assign to allow Git Sync jobs for authorized folders without granting the full global Editor role?