Using Grafana 5.2.1 with Elasticsearch. Now that we have Alerting capability (huge Thank You! BTW)has brought a few things to the surface.
A user with Viewer permission, and Grafana with view_can_edit enabled:
1 - has the ability to create folders
2- can also access and change the ‘Alerts’ section from the main menu.
I wouldn’t expect #1, I wouldn’t prefer #2. Happy to work on a PR if this is valid.