# Shield - Kibana4 - User Access Control - Keeping Marketing Matt from doing what comes naturally

**URL:** <https://discuss.elastic.co/t/shield-kibana4-user-access-control-keeping-marketing-matt-from-doing-what-comes-naturally/24017>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [June 19, 2015, 8:24pm UTC](https://discuss.elastic.co/t/shield-kibana4-user-access-control-keeping-marketing-matt-from-doing-what-comes-naturally/24017 "2015-06-19T20:24:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bdunbar](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@bdunbar](https://discuss.elastic.co/u/bdunbar)\
**Post date:** [June 19, 2015, 8:24pm UTC](https://discuss.elastic.co/t/shield-kibana4-user-access-control-keeping-marketing-matt-from-doing-what-comes-naturally/24017/1 "2015-06-19T20:24:37Z")

</div>

Seeking guidance. We're new to ES.

Using ES, Logstash, Kibana4 to provide webstats. We want very badly to be able to allow Matt from Marketing to login to Kibana, sort data, create visualizations and dashboards, but _not_ to have access to the Settings menu.

In short: I don't want them to be able to break things.

I can create a role that can only see a given index: great. I can assign a user to that role. I can _not_ figure out how to prevent the user from mucking around where he shouldn't go.

I'd even accept a non-Shield answer like .htaccess ...

Now, I agree: if we say 'don't do that' they should not do that. But even with the ' **Caution: You can break stuff here**' advisory people are gonna do what they shouldn't do.

So .. how 'bout it?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 20, 2015, 3:48am UTC](https://discuss.elastic.co/t/shield-kibana4-user-access-control-keeping-marketing-matt-from-doing-what-comes-naturally/24017/2 "2015-06-20T03:48:58Z")

</div>

Access control is coming in KB4.2, but not to that low level, till then it's DIY.

---

<div class="post-metadata">

**Author:** ![bdunbar](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@bdunbar](https://discuss.elastic.co/u/bdunbar)\
**Post date:** [June 22, 2015, 4:53pm UTC](https://discuss.elastic.co/t/shield-kibana4-user-access-control-keeping-marketing-matt-from-doing-what-comes-naturally/24017/3 "2015-06-22T16:53:58Z")

</div>

I'm looking forward to it. Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:49pm UTC](https://discuss.elastic.co/t/shield-kibana4-user-access-control-keeping-marketing-matt-from-doing-what-comes-naturally/24017/4 "2017-07-06T13:49:08Z")

</div>

Closed on July 6, 2017, 1:49pm UTC