# Cluster permission query

**URL:** <https://forum.search-guard.com/t/cluster-permission-query/838>\
**Category:** Search Guard\
**Created:** [March 16, 2018, 10:28am UTC](https://forum.search-guard.com/t/cluster-permission-query/838 "2018-03-16T10:28:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anthony\_Cleaves](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@Anthony\_Cleaves](https://forum.search-guard.com/u/Anthony_Cleaves)\
**Post date:** [March 16, 2018, 10:28am UTC](https://forum.search-guard.com/t/cluster-permission-query/838/1 "2018-03-16T10:28:39Z")

</div>

ES 6.1.3  
SG 6.1.3-20-SNAPSHOT

Hello, a quick query.

I have users that I have limited to certain indexes and DLS. So they can see certain docs, I am curious which cluster setting is more appropriate as if I give them a “CLUSTER\_COMPOSITE\_OPS\_RO” setting, they can save dashboards but not searches and if I give them “CLUSTER\_COMPOSITE\_OPS” they are then able to modify anything under the “management” section. Am I going to have to create my own action group per role?

This is what I want.

User

View certain indexes

Create Searches,visuals and dashboards for those indexes

NO permission on “management”

No rush on this query, thanks.

---

<div class="post-metadata">

**Author:** ![Anthony\_Cleaves](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@Anthony\_Cleaves](https://forum.search-guard.com/u/Anthony_Cleaves)\
**Post date:** [March 16, 2018, 11:47am UTC](https://forum.search-guard.com/t/cluster-permission-query/838/2 "2018-03-16T11:47:36Z")

</div>

I think mutlitenacy is the answer, ignore this query for now. Sorry

> **···**
>
> On Friday, 16 March 2018 10:28:39 UTC, [anthony...@actual-experience.com](mailto:anthony...@actual-experience.com) wrote:
> 
> > ES 6.1.3  
> > SG 6.1.3-20-SNAPSHOT
> 
> > 
> 
> > Hello, a quick query.
> 
> > 
> 
> > I have users that I have limited to certain indexes and DLS. So they can see certain docs, I am curious which cluster setting is more appropriate as if I give them a “CLUSTER\_COMPOSITE\_OPS\_RO” setting, they can save dashboards but not searches and if I give them “CLUSTER\_COMPOSITE\_OPS” they are then able to modify anything under the “management” section. Am I going to have to create my own action group per role?
> 
> > 
> 
> > This is what I want.
> 
> > 
> 
> > User
> 
> > View certain indexes
> 
> > Create Searches,visuals and dashboards for those indexes
> 
> > NO permission on “management”
> 
> > 
> 
> > No rush on this query, thanks.