> ## Documentation Index > Fetch the complete documentation index at: /docs/llms.txt > Use this file to discover all available pages before exploring further. # Permission changes > Every change to what Ordyn asks for in your tools, newest first. Each integration page lists the permissions Ordyn needs, generated from one permission catalog. When the catalog changes, its version goes up and Ordyn marks permission checks made under an earlier version as out of date until the connection is checked again. ## 2026-10-16.1 Grafana: added optional `alert.rules:read` for the service account, so investigations can read alert state history (recorded firings, observed flapping and the last recorded state in the selected window). Grafana's Viewer role includes it. Ordyn checks the history endpoint; if alert state history is turned off in Grafana, the check shows as not applicable. Grafana Cloud access-policy scopes such as `alert-state-history:read` are not needed: they never authorize the Grafana HTTP API. ## 2026-10-15.9 Managed Prometheus: AWS AMP query, rule inventory, native alert and SNS delivery actions are included in the setup policy and checked as optional capabilities. Azure checks PromQL per selected workspace and adds workspace-scoped Monitoring Data Reader and Prometheus rule-group writes. GCP PromQL uses the existing Monitoring roles. Native cloud monitoring remains available without Prometheus access. ## 2026-10-15.8 BigQuery: the note about write access now says what the connection check does: Ordyn rejects project-level BigQuery write permissions when it can verify them. ## 2026-10-15.7 Snowflake: added optional MONITOR on the warehouse, so Ordyn can see queries other users ran on it (without it, `INFORMATION_SCHEMA.QUERY_HISTORY` returns only the service user's own queries). The setup SQL grants it; it does not grant OPERATE. PostgreSQL: the new role's password is a value you enter yourself, and Ordyn lists it among the values left to fill instead of leaving a literal ``. Google Cloud: the setup command enables Ordyn's core APIs; the guidance now names the Cloud Run, Compute Engine, Kubernetes Engine and Cloud SQL Admin APIs that confirming deleted resources also calls, which setup does not enable. Datadog: validating a monitor definition is listed under `monitors_read`; `monitors_write` stays for creating, updating and deleting monitors. ## 2026-10-15.6 AWS: the create-role command passes the trust policy inline instead of writing `trust-policy.json` first, so a failed write can no longer leave an older trust policy for the new role. Google Cloud, BigQuery and Azure: the grant commands chain every step with `&&`, so a failed API enablement or role grant stops the rest and the command exits non-zero. Grafana: query access to the data sources you select shows as verified only after Ordyn runs a query on each of them; listing data sources alone leaves it unverified. Google Cloud: the guidance names the permissions the person running the setup command needs (`serviceusage.services.enable` and `resourcemanager.projects.setIamPolicy`). The docs keep the notes on individual permissions when roles also grant them, such as AWS `iam:SimulatePrincipalPolicy` and `cloudwatch:TagResource`. ## 2026-10-15.5 AWS: the create-role and update-role commands stop at the first step that fails, so a role that already exists gets no grants from the create command, and a failed policy attachment fails the update. Jira: the `read:servicedesk-request` and `write:servicedesk-request` scopes are requested during OAuth consent; Ordyn does not currently call the Jira Service Management request APIs. ## 2026-10-15.4 PlanetScale and BigQuery: added notes on granting less access. On the PlanetScale Postgres engine you can grant only the schemas you choose instead of `pg_read_all_data`, and on BigQuery you can grant Data Viewer on only the datasets you choose. The setup commands are unchanged. ## 2026-10-15.3 Optional access says when it is needed in its own description (for example Google Cloud's deleted-resource roles, Kubernetes pod metrics, Slack channel creation, GitHub repository webhooks and Jira Service Management). The docs no longer label each requirement with its features, read or write, and optional. ## 2026-10-15.2 Google Cloud: the setup commands enable the Cloud Asset, Cloud Resource Manager, Cloud Monitoring and Cloud Logging APIs before granting the roles. A disabled API now shows its checks as unverified and names the API, instead of reporting a missing role. ## 2026-10-15.1 PostgreSQL: the grant commands put role, database and schema names in double quotes, so names with capitals or punctuation stay as written, and refuse names longer than 63 bytes. They also say to reconnect to the database before the schema grants. AWS: removing older Ordyn inline policies stops at the first delete that fails. Grafana: dropped the Grafana Cloud `alert-state-history:read` scope, because no Ordyn feature reads alert state history yet. Setup commands now include optional access by default: Google Cloud grants Cloud Run Viewer, Compute Viewer, Kubernetes Engine Cluster Viewer and Cloud SQL Viewer (to confirm deleted resources), BigQuery grants BigQuery Connection User, the Kubernetes ServiceAccount can read pod metrics, and the Grafana steps name the optional ruler and Alertmanager actions and the Grafana Cloud data source scopes. Optional access is still not required for a connection to work. ## 2026-10-14.2 PostgreSQL: the read-only role is granted `USAGE` and `SELECT` on the schemas you choose in one database, plus default privileges for tables created later, instead of `pg_read_all_data`, which reads every database on the server. Snowflake: the one-database grant now includes `FUTURE` grants for schemas, tables and views created later. Asana, SSH tunnels (`ec2-instance-connect:SendSSHPublicKey` pushes a temporary key) and the Grafana Cloud `rules:write` and `alerts:write` scopes are now listed as changing things in your tool. AWS commands pass `--role-name=`. ## 2026-10-14.1 Added Slack, GitHub, Linear, Jira, Asana, Grafana, PostgreSQL, PlanetScale, BigQuery, Snowflake, SSH tunnels, Cursor and Devin. AWS: added `resource-explorer-2:ListResources` (the inventory read) to the inline policy, and `cloudwatch:GetMetricStatistics`, `logs:FilterLogEvents` and `logs:StopQuery` to the checked log and metric reads. Google Cloud: the checker now also verifies the alert policy and notification channel reads and `logging.logMetrics.get`. Datadog: removed `logs_read_index`, which Ordyn never uses. ## 2026-10-09.1 AWS: one inline policy name, `struct-coverage-access`, replacing older Ordyn policies. Datadog: added `dashboards_read`, `events_read` and `slos_read`. Sentry: added `alerts:read`. ## 2026-09-21.1 First catalog: AWS, Azure, Google Cloud, Datadog, Sentry and the log and metric providers. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.