diff --git a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
index 7804a9a1216..60948303af3 100644
--- a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
+++ b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
@@ -55,9 +55,9 @@ The following list contains role-based access control actions.
| `alert.rules.external:read` | - `datasources:*`
- `datasources:uid:*`
| Read alert rules in data sources that support alerting (Prometheus, Mimir, and Loki) |
| `alert.rules.external:write` | - `datasources:*`
- `datasources:uid:*`
| Create, update, and delete alert rules in data sources that support alerting (Mimir and Loki). |
| `alert.rules:create` | - `folders:*`
- `folders:uid:*`
| Create Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query. |
-| `alert.rules:delete` | - `folders:*`
- `folders:uid:*`
| Delete Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query. |
+| `alert.rules:delete` | - `folders:*`
- `folders:uid:*`
| Delete Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder. |
| `alert.rules:read` | - `folders:*`
- `folders:uid:*`
| Read Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query. |
-| `alert.rules:write` | - `folders:*`
- `folders:uid:*`
| Update Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query. |
+| `alert.rules:write` | - `folders:*`
- `folders:uid:*`
| Update Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder. To allow query modifications add `datasources:query` in the scope of data sources the user can query. |
| `alert.silences:create` | - `folders:*`
- `folders:uid:*`
| Create rule-specific silences in a folder and its subfolders. |
| `alert.silences:read` | - `folders:*`
- `folders:uid:*`
| Read all general silences and rule-specific silences in a folder and its subfolders. |
| `alert.silences:write` | - `folders:*`
- `folders:uid:*`
| Update and expire rule-specific silences in a folder and its subfolders. |
diff --git a/docs/sources/alerting/set-up/configure-rbac/_index.md b/docs/sources/alerting/set-up/configure-rbac/_index.md
index 647ef8ed535..101958c935b 100644
--- a/docs/sources/alerting/set-up/configure-rbac/_index.md
+++ b/docs/sources/alerting/set-up/configure-rbac/_index.md
@@ -27,30 +27,30 @@ Each permission contains one or more actions and a scope.
Grafana Alerting has the following permissions.
-| Action | Applicable scope | Description |
-| ------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `alert.instances.external:read` | `datasources:*`
`datasources:uid:*` | Read alerts and silences in data sources that support alerting. |
-| `alert.instances.external:write` | `datasources:*`
`datasources:uid:*` | Manage alerts and silences in data sources that support alerting. |
-| `alert.instances:create` | n/a | Create silences in the current organization. |
-| `alert.instances:read` | n/a | Read alerts and silences in the current organization. |
-| `alert.instances:write` | n/a | Update and expire silences in the current organization. |
-| `alert.notifications.external:read` | `datasources:*`
`datasources:uid:*` | Read templates, contact points, notification policies, and mute timings in data sources that support alerting. |
-| `alert.notifications.external:write` | `datasources:*`
`datasources:uid:*` | Manage templates, contact points, notification policies, and mute timings in data sources that support alerting. |
-| `alert.notifications:write` | n/a | Manage templates, contact points, notification policies, and mute timings in the current organization. |
-| `alert.notifications:read` | n/a | Read all templates, contact points, notification policies, and mute timings in the current organization. |
-| `alert.rules.external:read` | `datasources:*`
`datasources:uid:*` | Read alert rules in data sources that support alerting (Prometheus, Mimir, and Loki) |
-| `alert.rules.external:write` | `datasources:*`
`datasources:uid:*` | Create, update, and delete alert rules in data sources that support alerting (Mimir and Loki). |
-| `alert.rules:create` | `folders:*`
`folders:uid:*` | Create Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query. |
-| `alert.rules:delete` | `folders:*`
`folders:uid:*` | Delete Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query. |
-| `alert.rules:read` | `folders:*`
`folders:uid:*` | Read Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder. |
-| `alert.rules:write` | `folders:*`
`folders:uid:*` | Update Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query. |
-| `alert.silences:create` | `folders:*`
`folders:uid:*` | Create rule-specific silences in a folder and its subfolders. |
-| `alert.silences:read` | `folders:*`
`folders:uid:*` | Read all general silences and rule-specific silences in a folder and its subfolders. |
-| `alert.silences:write` | `folders:*`
`folders:uid:*` | Update and expire rule-specific silences in a folder and its subfolders. |
-| `alert.provisioning:read` | n/a | Read all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and data source are not required. |
-| `alert.provisioning.secrets:read` | n/a | Same as `alert.provisioning:read` plus ability to export resources with decrypted secrets. |
-| `alert.provisioning:write` | n/a | Update all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and data source are not required. |
-| `alert.provisioning.provenance:write` | n/a | Set provisioning status for alerting resources. Cannot be used alone. Requires user to have permissions to access resources |
+| Action | Applicable scope | Description |
+| ------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `alert.instances.external:read` | `datasources:*`
`datasources:uid:*` | Read alerts and silences in data sources that support alerting. |
+| `alert.instances.external:write` | `datasources:*`
`datasources:uid:*` | Manage alerts and silences in data sources that support alerting. |
+| `alert.instances:create` | n/a | Create silences in the current organization. |
+| `alert.instances:read` | n/a | Read alerts and silences in the current organization. |
+| `alert.instances:write` | n/a | Update and expire silences in the current organization. |
+| `alert.notifications.external:read` | `datasources:*`
`datasources:uid:*` | Read templates, contact points, notification policies, and mute timings in data sources that support alerting. |
+| `alert.notifications.external:write` | `datasources:*`
`datasources:uid:*` | Manage templates, contact points, notification policies, and mute timings in data sources that support alerting. |
+| `alert.notifications:write` | n/a | Manage templates, contact points, notification policies, and mute timings in the current organization. |
+| `alert.notifications:read` | n/a | Read all templates, contact points, notification policies, and mute timings in the current organization. |
+| `alert.rules.external:read` | `datasources:*`
`datasources:uid:*` | Read alert rules in data sources that support alerting (Prometheus, Mimir, and Loki) |
+| `alert.rules.external:write` | `datasources:*`
`datasources:uid:*` | Create, update, and delete alert rules in data sources that support alerting (Mimir and Loki). |
+| `alert.rules:create` | `folders:*`
`folders:uid:*` | Create Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder and `datasources:query` in the scope of data sources the user can query. |
+| `alert.rules:delete` | `folders:*`
`folders:uid:*` | Delete Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder. |
+| `alert.rules:read` | `folders:*`
`folders:uid:*` | Read Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder. |
+| `alert.rules:write` | `folders:*`
`folders:uid:*` | Update Grafana alert rules in a folder and its subfolders. Combine this permission with `folders:read` in a scope that includes the folder. To allow query modifications add `datasources:query` in the scope of data sources the user can query. |
+| `alert.silences:create` | `folders:*`
`folders:uid:*` | Create rule-specific silences in a folder and its subfolders. |
+| `alert.silences:read` | `folders:*`
`folders:uid:*` | Read all general silences and rule-specific silences in a folder and its subfolders. |
+| `alert.silences:write` | `folders:*`
`folders:uid:*` | Update and expire rule-specific silences in a folder and its subfolders. |
+| `alert.provisioning:read` | n/a | Read all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and data source are not required. |
+| `alert.provisioning.secrets:read` | n/a | Same as `alert.provisioning:read` plus ability to export resources with decrypted secrets. |
+| `alert.provisioning:write` | n/a | Update all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and data source are not required. |
+| `alert.provisioning.provenance:write` | n/a | Set provisioning status for alerting resources. Cannot be used alone. Requires user to have permissions to access resources |
Contact point permissions. To enable API and user interface that use these permissions, enable the `alertingApiServer` feature toggle.
diff --git a/docs/sources/alerting/set-up/configure-rbac/access-folders/index.md b/docs/sources/alerting/set-up/configure-rbac/access-folders/index.md
index fcecc6fcf23..10fb63385ff 100644
--- a/docs/sources/alerting/set-up/configure-rbac/access-folders/index.md
+++ b/docs/sources/alerting/set-up/configure-rbac/access-folders/index.md
@@ -21,7 +21,7 @@ weight: 200
You can extend the access provided by a role to alert rules and rule-specific silences by assigning permissions to individual folders or data sources.
{{< admonition type="note" >}}
-Data source query permissions are required to create or modify an alert rule using that data source.
+Data source query permissions are required to create an alert rule or modify an alert rule's query using that data source.
{{< /admonition >}}
This allows different users, teams, or service accounts to have customized access to modify or silence alert rules in specific folders or using specific data sources.
@@ -65,7 +65,7 @@ To manage folder permissions, complete the following steps.
By default, users with the basic roles Admin, Editor, and Viewer roles have query access to data sources for Grafana Alerting.
-If you used fixed roles or custom roles, you need to update data source permissions.
+If you used fixed roles or custom roles, you need to update data source permissions to create rules or update rule queries.
Alternatively, an administrator can assign the role **Datasource Reader**, which grants the user access to all data sources.