Add documentation for access control and feature availability

[ktsaou]

Summary

• Add new document explaining access control policies and feature availability across Netdata's three access levels
• Covers Anonymous (no sign-in), Netdata Cloud Community, and Netdata Cloud Business tiers
• Documents sensitive functions that require authentication, node limits, custom dashboard limits, AI features, and MCP availability

Test plan

• Review document for accuracy
• Verify tables render correctly on learn site

---

Summary by cubic

Add a new docs page explaining Netdata’s access control and feature availability across Anonymous, Netdata Cloud Community, and Business tiers. It clarifies which functions require sign-in, node and custom dashboard limits, AI features, MCP access, and how to enable restricted features.

^{Written for commit ebe4ec4. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 1 file

Confidence score: 5/5

• Minor docs-only inconsistency in docs/netdata-oss-limitations.md about custom dashboard limits; low user-impact and easy to fix.
• Score reflects low severity (3/10) and no functional code changes indicated.
• Pay close attention to docs/netdata-oss-limitations.md - align the summary table with the earlier limit statement.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="docs/netdata-oss-limitations.md">

<violation number="1" location="docs/netdata-oss-limitations.md:135">
P3: Custom dashboard limits are inconsistent ("1 per agent" vs "1 per room"). Align the summary table with the earlier limits so readers get a single, clear value.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant Client as User / MCP Client
    participant Agent as Netdata Agent
    participant Cloud as Netdata Cloud
    participant Billing as Subscription Service

    Note over Client, Agent: Anonymous Access (Public)
    Client->>Agent: Request real-time metrics
    Agent->>Agent: Check sensitivity level
    Agent-->>Client: Return Metric Data (Anonymous Level)

    Note over Client, Agent: Sensitive Data Access
    Client->>Agent: CHANGED: Request Sensitive Function (Logs, Processes)
    Agent->>Agent: Check Authentication
    alt Not Signed In
        Agent-->>Client: 401 Unauthorized / Blocked
    else Signed In (Netdata Cloud)
        Agent->>Cloud: Validate User Session & Space Membership
        Cloud-->>Agent: Authorized
        Agent-->>Client: Return Sensitive Data
    end

    Note over Client, Billing: Feature Availability (Tiers)
    Client->>Cloud: Access Multi-node View / Custom Dashboards
    Cloud->>Billing: Get Account Tier (Community vs Business)
    
    alt Community Tier (Free)
        Billing-->>Cloud: Tier: Community
        Cloud->>Cloud: NEW: Enforce 5-node limit
        Cloud->>Cloud: NEW: Enforce 1 custom dashboard limit
        Cloud-->>Client: Render UI (Limited)
    else Business Tier (Paid)
        Billing-->>Cloud: Tier: Business
        Cloud->>Cloud: NEW: Remove Node/Dashboard limits
        Cloud->>Agent: NEW: Enable Dynamic Configuration APIs
        Cloud->>Cloud: Enable RBAC & SSO
        Cloud-->>Client: Render UI (Full Access)
    end

    Note over Client, Agent: MCP (Model Context Protocol) Flow
    Client->>Agent: Query via MCP
    alt No Cloud Connection
        Agent->>Agent: NEW: Restricted to Public Functions
        Agent-->>Client: Metrics/Public Data
    else Cloud Connection Active
        Agent->>Cloud: Inherit User Permissions
        Cloud-->>Agent: Authorization Context
        Agent-->>Client: Sensitive Data + AI Insights
    end

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}