Admin-controlled permissions for sidebar panels, Media Browser, and sensitive entities

[yunusuztr]

Describe your core improvement

Add admin-managed access permissions for sidebar panels, the Media Browser, and privacy-sensitive entities such as cameras and media sources.

Home Assistant should allow an administrator to decide which users or user groups can access panels like Media, and which users can see or access specific sensitive entities such as cameras, baby monitors, security cameras, local media, and recordings.

Current limitations

Non-admin users have restricted access to system settings, but they can still access some privacy-sensitive areas such as Media > Cameras.

Dashboard visibility can hide a camera card from specific users, but the same camera may still appear through the Media Browser. Sidebar hiding is also only a user preference or a custom frontend workaround. It is not reliable access control, because users can customize their own sidebar or access resources through another UI path or direct URL.

Custom sidebar plugins can hide panels visually, but they may break after updates and should not be relied on for privacy or security.

Technical benefits

• Provides a real permission model for shared Home Assistant installations
• Reduces privacy risks around cameras, baby monitors, local media, and recordings
• Avoids relying on custom frontend hiding as a security workaround
• Makes non-admin accounts more useful for household members and guests
• Aligns dashboard visibility, sidebar visibility, Media Browser access, and entity access with a consistent admin-controlled permission system

Additional context

Example household use case:

A family member or guest should be able to use Home Assistant for lights, switches, climate controls, and selected dashboards. However, they should not automatically have access to private cameras or media.

Today, an admin can hide a camera card from a dashboard for that user, but the camera can still be visible in Media > Cameras. This means dashboard visibility gives a false sense of privacy unless Media access is also restricted.

Expected behavior:

• Allow or deny access to sidebar panels per user or user group
• Allow or deny Media Browser access per user or user group
• Allow or deny camera/media-source visibility per user or user group
• Prevent restricted users from accessing hidden resources via direct URL or alternate UI paths

[kattcrazy]

Overlaps https://github.com/orgs/home-assistant/discussions/1161 regarding permissions. I hadn't thought of the media browser.

[Petro31]

This is a duplicate of RBAC

https://github.com/orgs/home-assistant/discussions/22