test(authz): clear downtime rule links before deleting the schedule

A schedule that still references rules cannot be deleted, so the teardown empties alertIds first. Admin doing that removal is also the allow half of the detach pair the scoped actor is refused.
test(authz): prove the link diff is enforced, not just resolved
2026-10-15 14:40:41 +01:00 · 2026-10-14 21:18:42 +05:30 · 2026-10-14 20:47:11 +05:30 · 2026-10-14 20:40:42 +05:30 · 2026-10-14 19:49:15 +05:30 · 2026-10-14 19:49:11 +05:30
22 changed files with 2719 additions and 372 deletions
--- a/docs/api/openapi.yml
+++ b/docs/api/openapi.yml
@@ -12964,9 +12964,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - planned-maintenance:list
      - tokenizer:
-        - VIEWER
+        - planned-maintenance:list
      summary: List downtime schedules
      tags:
      - downtimeschedules
@@ -13021,9 +13021,13 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - planned-maintenance:create
+        - planned-maintenance:attach
+        - rule:attach
      - tokenizer:
-        - EDITOR
+        - planned-maintenance:create
+        - planned-maintenance:attach
+        - rule:attach
      summary: Create downtime schedule
      tags:
      - downtimeschedules
@@ -13068,9 +13072,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - planned-maintenance:delete
      - tokenizer:
-        - EDITOR
+        - planned-maintenance:delete
      summary: Delete downtime schedule
      tags:
      - downtimeschedules
@@ -13126,9 +13130,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - planned-maintenance:read
      - tokenizer:
-        - VIEWER
+        - planned-maintenance:read
      summary: Get downtime schedule by ID
      tags:
      - downtimeschedules
@@ -13183,9 +13187,17 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - planned-maintenance:update
+        - planned-maintenance:attach
+        - planned-maintenance:detach
+        - rule:attach
+        - rule:detach
      - tokenizer:
-        - EDITOR
+        - planned-maintenance:update
+        - planned-maintenance:attach
+        - planned-maintenance:detach
+        - rule:attach
+        - rule:detach
      summary: Update downtime schedule
      tags:
      - downtimeschedules
@@ -14407,9 +14419,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - route-policy:list
      - tokenizer:
-        - VIEWER
+        - route-policy:list
      summary: List route policies
      tags:
      - routepolicies
@@ -14464,9 +14476,13 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - ADMIN
+        - route-policy:create
+        - route-policy:attach
+        - notification-channel:attach
      - tokenizer:
-        - ADMIN
+        - route-policy:create
+        - route-policy:attach
+        - notification-channel:attach
      summary: Create route policy
      tags:
      - routepolicies
@@ -14511,9 +14527,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - ADMIN
+        - route-policy:delete
      - tokenizer:
-        - ADMIN
+        - route-policy:delete
      summary: Delete route policy
      tags:
      - routepolicies
@@ -14569,9 +14585,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - route-policy:read
      - tokenizer:
-        - VIEWER
+        - route-policy:read
      summary: Get route policy by ID
      tags:
      - routepolicies
@@ -14638,9 +14654,17 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - ADMIN
+        - route-policy:update
+        - route-policy:attach
+        - route-policy:detach
+        - notification-channel:attach
+        - notification-channel:detach
      - tokenizer:
-        - ADMIN
+        - route-policy:update
+        - route-policy:attach
+        - route-policy:detach
+        - notification-channel:attach
+        - notification-channel:detach
      summary: Update route policy
      tags:
      - routepolicies
@@ -22040,9 +22064,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:list
      - tokenizer:
-        - VIEWER
+        - rule:list
      summary: List rule saved views
      tags:
      - rules
@@ -22098,9 +22122,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:list
      - tokenizer:
-        - VIEWER
+        - rule:list
      summary: Create rule saved view
      tags:
      - rules
@@ -22152,9 +22176,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:list
      - tokenizer:
-        - VIEWER
+        - rule:list
      summary: Delete rule saved view
      tags:
      - rules
@@ -22221,9 +22245,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:list
      - tokenizer:
-        - VIEWER
+        - rule:list
      summary: Update rule saved view
      tags:
      - rules
@@ -22272,9 +22296,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:list
      - tokenizer:
-        - VIEWER
+        - rule:list
      summary: List alert rules
      tags:
      - rules
@@ -23113,9 +23137,13 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - rule:create
+        - rule:attach
+        - notification-channel:attach
      - tokenizer:
-        - EDITOR
+        - rule:create
+        - rule:attach
+        - notification-channel:attach
      summary: Create alert rule
      tags:
      - rules
@@ -23160,9 +23188,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - rule:delete
      - tokenizer:
-        - EDITOR
+        - rule:delete
      summary: Delete alert rule
      tags:
      - rules
@@ -23218,9 +23246,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:read
      - tokenizer:
-        - VIEWER
+        - rule:read
      summary: Get alert rule by ID
      tags:
      - rules
@@ -24071,9 +24099,17 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - rule:update
+        - rule:attach
+        - rule:detach
+        - notification-channel:attach
+        - notification-channel:detach
      - tokenizer:
-        - EDITOR
+        - rule:update
+        - rule:attach
+        - rule:detach
+        - notification-channel:attach
+        - notification-channel:detach
      summary: Patch alert rule
      tags:
      - rules
@@ -24912,9 +24948,17 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - rule:update
+        - rule:attach
+        - rule:detach
+        - notification-channel:attach
+        - notification-channel:detach
      - tokenizer:
-        - EDITOR
+        - rule:update
+        - rule:attach
+        - rule:detach
+        - notification-channel:attach
+        - notification-channel:detach
      summary: Update alert rule
      tags:
      - rules
@@ -25014,9 +25058,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:read
      - tokenizer:
-        - VIEWER
+        - rule:read
      summary: Get rule history filter keys
      tags:
      - rules
@@ -25124,9 +25168,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:read
      - tokenizer:
-        - VIEWER
+        - rule:read
      summary: Get rule history filter values
      tags:
      - rules
@@ -25199,9 +25243,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:read
      - tokenizer:
-        - VIEWER
+        - rule:read
      summary: Get rule overall status timeline
      tags:
      - rules
@@ -25271,9 +25315,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:read
      - tokenizer:
-        - VIEWER
+        - rule:read
      summary: Get rule history stats
      tags:
      - rules
@@ -25363,9 +25407,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:read
      - tokenizer:
-        - VIEWER
+        - rule:read
      summary: Get rule history timeline
      tags:
      - rules
@@ -25438,9 +25482,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:read
      - tokenizer:
-        - VIEWER
+        - rule:read
      summary: Get top contributors to rule firing
      tags:
      - rules
@@ -26280,9 +26324,13 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - rule:create
+        - rule:attach
+        - notification-channel:attach
      - tokenizer:
-        - EDITOR
+        - rule:create
+        - rule:attach
+        - notification-channel:attach
      summary: Test alert rule
      tags:
      - rules
@@ -28148,9 +28196,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - rule:list
      - tokenizer:
-        - VIEWER
+        - rule:list
      summary: List alert rules (v3)
      tags:
      - rules
--- a/pkg/apiserver/signozapiserver/alertmanager.go
+++ b/pkg/apiserver/signozapiserver/alertmanager.go
@@ -4,6 +4,7 @@ import (
 	"net/http"

 	"github.com/SigNoz/signoz/pkg/http/handler"
+	"github.com/SigNoz/signoz/pkg/ruler/rulerauthz"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
@@ -327,88 +328,167 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 		return err
 	}

-	if err := router.Handle("/api/v1/route_policies", handler.New(provider.authzMiddleware.ViewAccess(provider.alertmanagerHandler.GetAllRoutePolicies), handler.OpenAPIDef{
-		ID:                  "GetAllRoutePolicies",
-		Tags:                []string{"routepolicies"},
-		Summary:             "List route policies",
-		Description:         "This endpoint lists all route policies for the organization",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*alertmanagertypes.GettableRoutePolicy, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.GetAllRoutePolicies, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetAllRoutePolicies",
+			Tags:                []string{"routepolicies"},
+			Summary:             "List route policies",
+			Description:         "This endpoint lists all route policies for the organization",
+			Response:            make([]*alertmanagertypes.GettableRoutePolicy, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.alertmanagerHandler.GetRoutePolicyByID), handler.OpenAPIDef{
-		ID:                  "GetRoutePolicyByID",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Get route policy by ID",
-		Description:         "This endpoint returns a route policy by ID",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(alertmanagertypes.GettableRoutePolicy),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.GetRoutePolicyByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetRoutePolicyByID",
+			Tags:                []string{"routepolicies"},
+			Summary:             "Get route policy by ID",
+			Description:         "This endpoint returns a route policy by ID",
+			Response:            new(alertmanagertypes.GettableRoutePolicy),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/route_policies", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.CreateRoutePolicy), handler.OpenAPIDef{
-		ID:                  "CreateRoutePolicy",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Create route policy",
-		Description:         "This endpoint creates a route policy",
-		Request:             new(alertmanagertypes.PostableRoutePolicy),
-		RequestContentType:  "application/json",
-		Response:            new(alertmanagertypes.GettableRoutePolicy),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.CreateRoutePolicy, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateRoutePolicy",
+			Tags:                []string{"routepolicies"},
+			Summary:             "Create route policy",
+			Description:         "This endpoint creates a route policy",
+			Request:             new(alertmanagertypes.PostableRoutePolicy),
+			RequestContentType:  "application/json",
+			Response:            new(alertmanagertypes.GettableRoutePolicy),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRoutePolicy,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
+				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewCreateRoutePolicyChannelAttachExtractor(provider.alertmanagerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.UpdateRoutePolicy), handler.OpenAPIDef{
-		ID:                  "UpdateRoutePolicy",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Update route policy",
-		Description:         "This endpoint updates a route policy by ID",
-		Request:             new(alertmanagertypes.PostableRoutePolicy),
-		RequestContentType:  "application/json",
-		Response:            new(alertmanagertypes.GettableRoutePolicy),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.UpdateRoutePolicy, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateRoutePolicy",
+			Tags:                []string{"routepolicies"},
+			Summary:             "Update route policy",
+			Description:         "This endpoint updates a route policy by ID",
+			Request:             new(alertmanagertypes.PostableRoutePolicy),
+			RequestContentType:  "application/json",
+			Response:            new(alertmanagertypes.GettableRoutePolicy),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbUpdate),
+				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbDetach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRoutePolicy,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewUpdateRoutePolicyChannelAttachExtractor(provider.alertmanagerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewUpdateRoutePolicyChannelDetachExtractor(provider.alertmanagerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.DeleteRoutePolicyByID), handler.OpenAPIDef{
-		ID:                  "DeleteRoutePolicyByID",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Delete route policy",
-		Description:         "This endpoint deletes a route policy by ID",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.DeleteRoutePolicyByID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteRoutePolicyByID",
+			Tags:              []string{"routepolicies"},
+			Summary:           "Delete route policy",
+			Description:       "This endpoint deletes a route policy by ID",
+			SuccessStatusCode: http.StatusNoContent,
+			ErrorStatusCodes:  []int{http.StatusNotFound},
+			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

--- a/pkg/apiserver/signozapiserver/provider.go
+++ b/pkg/apiserver/signozapiserver/provider.go
@@ -91,9 +91,11 @@ type provider struct {
 	ruleStateHistoryHandler    rulestatehistory.Handler
 	spanMapperHandler          spanmapper.Handler
 	alertmanagerHandler        alertmanager.Handler
+	alertmanagerService        alertmanager.Alertmanager
 	prometheusHandler          prometheus.Handler
 	traceDetailHandler         tracedetail.Handler
 	rulerHandler               ruler.Handler
+	rulerService               ruler.Ruler
 	llmPricingRuleHandler      llmpricingrule.Handler
 	statsHandler               statsreporter.Handler
 	savedViewHandler           savedview.Handler
@@ -136,10 +138,12 @@ func NewFactory(
 	ruleStateHistoryHandler rulestatehistory.Handler,
 	spanMapperHandler spanmapper.Handler,
 	alertmanagerHandler alertmanager.Handler,
+	alertmanagerService alertmanager.Alertmanager,
 	prometheusHandler prometheus.Handler,
 	llmPricingRuleHandler llmpricingrule.Handler,
 	traceDetailHandler tracedetail.Handler,
 	rulerHandler ruler.Handler,
+	rulerService ruler.Ruler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
 	globalConfig global.Config,
@@ -189,10 +193,12 @@ func NewFactory(
 			ruleStateHistoryHandler,
 			spanMapperHandler,
 			alertmanagerHandler,
+			alertmanagerService,
 			prometheusHandler,
 			llmPricingRuleHandler,
 			traceDetailHandler,
 			rulerHandler,
+			rulerService,
 			statsHandler,
 			savedViewHandler,
 			globalConfig,
@@ -244,10 +250,12 @@ func newProvider(
 	ruleStateHistoryHandler rulestatehistory.Handler,
 	spanMapperHandler spanmapper.Handler,
 	alertmanagerHandler alertmanager.Handler,
+	alertmanagerService alertmanager.Alertmanager,
 	prometheusHandler prometheus.Handler,
 	llmPricingRuleHandler llmpricingrule.Handler,
 	traceDetailHandler tracedetail.Handler,
 	rulerHandler ruler.Handler,
+	rulerService ruler.Ruler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
 	globalConfig global.Config,
@@ -299,9 +307,11 @@ func newProvider(
 		ruleStateHistoryHandler:    ruleStateHistoryHandler,
 		spanMapperHandler:          spanMapperHandler,
 		alertmanagerHandler:        alertmanagerHandler,
+		alertmanagerService:        alertmanagerService,
 		prometheusHandler:          prometheusHandler,
 		traceDetailHandler:         traceDetailHandler,
 		rulerHandler:               rulerHandler,
+		rulerService:               rulerService,
 		llmPricingRuleHandler:      llmPricingRuleHandler,
 		statsHandler:               statsHandler,
 		savedViewHandler:           savedViewHandler,
@@ -532,8 +542,5 @@ func newAnonymousSecuritySchemes(scopes []string) []handler.OpenAPISecuritySchem
 }

 func newScopedSecuritySchemes(scopes []string) []handler.OpenAPISecurityScheme {
-	return []handler.OpenAPISecurityScheme{
-		{Name: authtypes.IdentNProviderAPIKey.StringValue(), Scopes: scopes},
-		{Name: authtypes.IdentNProviderTokenizer.StringValue(), Scopes: scopes},
-	}
+	return handler.NewScopedSecuritySchemes(scopes)
 }
--- a/pkg/apiserver/signozapiserver/ruler.go
+++ b/pkg/apiserver/signozapiserver/ruler.go
@@ -4,259 +4,554 @@ import (
 	"net/http"

 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/ruler/rulerauthz"
 	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/ruletypes"
 	"github.com/gorilla/mux"
 )

 func (provider *provider) addRulerRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/rules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRules), handler.OpenAPIDef{
-		ID:                  "ListRules",
-		Tags:                []string{"rules"},
-		Summary:             "List alert rules",
-		Description:         "This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.",
-		Response:            make([]*ruletypes.Rule, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		Deprecated:          true,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListRules",
+			Tags:                []string{"rules"},
+			Summary:             "List alert rules",
+			Description:         "This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.",
+			Response:            make([]*ruletypes.Rule, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			Deprecated:          true,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v3/rules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRulesV3), handler.OpenAPIDef{
-		ID:                  "ListRulesV3",
-		Tags:                []string{"rules"},
-		Summary:             "List alert rules (v3)",
-		Description:         "Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). In the filter DSL, a non-reserved key is matched as a rule label directly (`team = infra`); a key that collides with a reserved keyword matches either interpretation (negative operators exclude both), and `labels.<key>` targets only the label. The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.",
-		RequestQuery:        new(ruletypes.ListRulesParams),
-		Response:            new(ruletypes.ListableRules),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v3/rules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRulesV3, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListRulesV3",
+			Tags:                []string{"rules"},
+			Summary:             "List alert rules (v3)",
+			Description:         "Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). In the filter DSL, a non-reserved key is matched as a rule label directly (`team = infra`); a key that collides with a reserved keyword matches either interpretation (negative operators exclude both), and `labels.<key>` targets only the label. The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.",
+			RequestQuery:        new(ruletypes.ListRulesParams),
+			Response:            new(ruletypes.ListableRules),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.GetRuleByID), handler.OpenAPIDef{
-		ID:                  "GetRuleByID",
-		Tags:                []string{"rules"},
-		Summary:             "Get alert rule by ID",
-		Description:         "This endpoint returns an alert rule by ID",
-		Response:            new(ruletypes.Rule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.GetRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetRuleByID",
+			Tags:                []string{"rules"},
+			Summary:             "Get alert rule by ID",
+			Description:         "This endpoint returns an alert rule by ID",
+			Response:            new(ruletypes.Rule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CreateRule), handler.OpenAPIDef{
-		ID:                  "CreateRule",
-		Tags:                []string{"rules"},
-		Summary:             "Create alert rule",
-		Description:         "This endpoint creates a new alert rule",
-		Request:             new(ruletypes.PostableRule),
-		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
-		Response:            new(ruletypes.Rule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateRule",
+			Tags:                []string{"rules"},
+			Summary:             "Create alert rule",
+			Description:         "This endpoint creates a new alert rule",
+			Request:             new(ruletypes.PostableRule),
+			RequestContentType:  "application/json",
+			RequestExamples:     postableRuleExamples(),
+			Response:            new(ruletypes.Rule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewCreateChannelAttachExtractor(provider.alertmanagerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.UpdateRuleByID), handler.OpenAPIDef{
-		ID:                 "UpdateRuleByID",
-		Tags:               []string{"rules"},
-		Summary:            "Update alert rule",
-		Description:        "This endpoint updates an alert rule by ID",
-		Request:            new(ruletypes.PostableRule),
-		RequestContentType: "application/json",
-		RequestExamples:    postableRuleExamples(),
-		SuccessStatusCode:  http.StatusNoContent,
-		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                 "UpdateRuleByID",
+			Tags:               []string{"rules"},
+			Summary:            "Update alert rule",
+			Description:        "This endpoint updates an alert rule by ID",
+			Request:            new(ruletypes.PostableRule),
+			RequestContentType: "application/json",
+			RequestExamples:    postableRuleExamples(),
+			SuccessStatusCode:  http.StatusNoContent,
+			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewReplaceChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewReplaceChannelDetachExtractor(provider.alertmanagerService, provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.DeleteRuleByID), handler.OpenAPIDef{
-		ID:                "DeleteRuleByID",
-		Tags:              []string{"rules"},
-		Summary:           "Delete alert rule",
-		Description:       "This endpoint deletes an alert rule by ID",
-		SuccessStatusCode: http.StatusNoContent,
-		ErrorStatusCodes:  []int{http.StatusNotFound},
-		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteRuleByID",
+			Tags:              []string{"rules"},
+			Summary:           "Delete alert rule",
+			Description:       "This endpoint deletes an alert rule by ID",
+			SuccessStatusCode: http.StatusNoContent,
+			ErrorStatusCodes:  []int{http.StatusNotFound},
+			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.PatchRuleByID), handler.OpenAPIDef{
-		ID:                  "PatchRuleByID",
-		Tags:                []string{"rules"},
-		Summary:             "Patch alert rule",
-		Description:         "This endpoint applies a partial update to an alert rule by ID",
-		Request:             new(ruletypes.PostableRule),
-		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
-		Response:            new(ruletypes.Rule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPatch).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.PatchRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "PatchRuleByID",
+			Tags:                []string{"rules"},
+			Summary:             "Patch alert rule",
+			Description:         "This endpoint applies a partial update to an alert rule by ID",
+			Request:             new(ruletypes.PostableRule),
+			RequestContentType:  "application/json",
+			RequestExamples:     postableRuleExamples(),
+			Response:            new(ruletypes.Rule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewPatchChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewPatchChannelDetachExtractor(provider.alertmanagerService, provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules/test", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.TestRule), handler.OpenAPIDef{
-		ID:                  "TestRule",
-		Tags:                []string{"rules"},
-		Summary:             "Test alert rule",
-		Description:         "This endpoint fires a test notification for the given rule definition",
-		Request:             new(ruletypes.PostableRule),
-		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
-		Response:            new(ruletypes.GettableTestRule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/test", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.TestRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "TestRule",
+			Tags:                []string{"rules"},
+			Summary:             "Test alert rule",
+			Description:         "This endpoint fires a test notification for the given rule definition",
+			Request:             new(ruletypes.PostableRule),
+			RequestContentType:  "application/json",
+			RequestExamples:     postableRuleExamples(),
+			Response:            new(ruletypes.GettableTestRule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewCreateChannelAttachExtractor(provider.alertmanagerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRuleViews), handler.OpenAPIDef{
-		ID:                  "ListRuleViews",
-		Tags:                []string{"rules"},
-		Summary:             "List rule saved views",
-		Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
-		Response:            new(ruletypes.ListableRuleViews),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRuleViews, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListRuleViews",
+			Tags:                []string{"rules"},
+			Summary:             "List rule saved views",
+			Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
+			Response:            new(ruletypes.ListableRuleViews),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.CreateRuleView), handler.OpenAPIDef{
-		ID:                  "CreateRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Create rule saved view",
-		Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
-		Request:             new(ruletypes.PostableRuleView),
-		RequestContentType:  "application/json",
-		Response:            new(ruletypes.RuleView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Create rule saved view",
+			Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
+			Request:             new(ruletypes.PostableRuleView),
+			RequestContentType:  "application/json",
+			Response:            new(ruletypes.RuleView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.UpdateRuleView), handler.OpenAPIDef{
-		ID:                  "UpdateRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Update rule saved view",
-		Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
-		Request:             new(ruletypes.UpdatableRuleView),
-		RequestContentType:  "application/json",
-		Response:            new(ruletypes.RuleView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Update rule saved view",
+			Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
+			Request:             new(ruletypes.UpdatableRuleView),
+			RequestContentType:  "application/json",
+			Response:            new(ruletypes.RuleView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.DeleteRuleView), handler.OpenAPIDef{
-		ID:                  "DeleteRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Delete rule saved view",
-		Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Delete rule saved view",
+			Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListDowntimeSchedules), handler.OpenAPIDef{
-		ID:                  "ListDowntimeSchedules",
-		Tags:                []string{"downtimeschedules"},
-		Summary:             "List downtime schedules",
-		Description:         "This endpoint lists all planned maintenance / downtime schedules",
-		RequestQuery:        new(alertmanagertypes.ListPlannedMaintenanceParams),
-		Response:            make([]*alertmanagertypes.PlannedMaintenance, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListDowntimeSchedules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListDowntimeSchedules",
+			Tags:                []string{"downtimeschedules"},
+			Summary:             "List downtime schedules",
+			Description:         "This endpoint lists all planned maintenance / downtime schedules",
+			RequestQuery:        new(alertmanagertypes.ListPlannedMaintenanceParams),
+			Response:            make([]*alertmanagertypes.PlannedMaintenance, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.GetDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                  "GetDowntimeScheduleByID",
-		Tags:                []string{"downtimeschedules"},
-		Summary:             "Get downtime schedule by ID",
-		Description:         "This endpoint returns a downtime schedule by ID",
-		Response:            new(alertmanagertypes.PlannedMaintenance),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.GetDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetDowntimeScheduleByID",
+			Tags:                []string{"downtimeschedules"},
+			Summary:             "Get downtime schedule by ID",
+			Description:         "This endpoint returns a downtime schedule by ID",
+			Response:            new(alertmanagertypes.PlannedMaintenance),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CreateDowntimeSchedule), handler.OpenAPIDef{
-		ID:                  "CreateDowntimeSchedule",
-		Tags:                []string{"downtimeschedules"},
-		Summary:             "Create downtime schedule",
-		Description:         "This endpoint creates a new planned maintenance / downtime schedule",
-		Request:             new(alertmanagertypes.PostablePlannedMaintenance),
-		RequestContentType:  "application/json",
-		Response:            new(alertmanagertypes.PlannedMaintenance),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateDowntimeSchedule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateDowntimeSchedule",
+			Tags:                []string{"downtimeschedules"},
+			Summary:             "Create downtime schedule",
+			Description:         "This endpoint creates a new planned maintenance / downtime schedule",
+			Request:             new(alertmanagertypes.PostablePlannedMaintenance),
+			RequestContentType:  "application/json",
+			Response:            new(alertmanagertypes.PlannedMaintenance),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
+				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceRule,
+				TargetIDs:      rulerauthz.DowntimeRuleIDsExtractor,
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.UpdateDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                 "UpdateDowntimeScheduleByID",
-		Tags:               []string{"downtimeschedules"},
-		Summary:            "Update downtime schedule",
-		Description:        "This endpoint updates a downtime schedule by ID",
-		Request:            new(alertmanagertypes.PostablePlannedMaintenance),
-		RequestContentType: "application/json",
-		SuccessStatusCode:  http.StatusNoContent,
-		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                 "UpdateDowntimeScheduleByID",
+			Tags:               []string{"downtimeschedules"},
+			Summary:            "Update downtime schedule",
+			Description:        "This endpoint updates a downtime schedule by ID",
+			Request:            new(alertmanagertypes.PostablePlannedMaintenance),
+			RequestContentType: "application/json",
+			SuccessStatusCode:  http.StatusNoContent,
+			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbUpdate),
+				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbDetach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceRule,
+				TargetIDs:      rulerauthz.NewDowntimeRuleAttachExtractor(provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceRule,
+				TargetIDs:      rulerauthz.NewDowntimeRuleDetachExtractor(provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.DeleteDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                "DeleteDowntimeScheduleByID",
-		Tags:              []string{"downtimeschedules"},
-		Summary:           "Delete downtime schedule",
-		Description:       "This endpoint deletes a downtime schedule by ID",
-		SuccessStatusCode: http.StatusNoContent,
-		ErrorStatusCodes:  []int{http.StatusNotFound},
-		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteDowntimeScheduleByID",
+			Tags:              []string{"downtimeschedules"},
+			Summary:           "Delete downtime schedule",
+			Description:       "This endpoint deletes a downtime schedule by ID",
+			SuccessStatusCode: http.StatusNoContent,
+			ErrorStatusCodes:  []int{http.StatusNotFound},
+			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

--- a/pkg/apiserver/signozapiserver/rulestatehistory.go
+++ b/pkg/apiserver/signozapiserver/rulestatehistory.go
@@ -4,7 +4,8 @@ import (
 	"net/http"

 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/rulestatehistorytypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/gorilla/mux"
@@ -13,7 +14,7 @@ import (
 func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {

 	if err := router.Handle("/api/v2/rules/{id}/history/stats", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryStats),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryStats, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryStats",
 			Tags:                []string{"rules"},
@@ -24,13 +25,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v2/rules/{id}/history/timeline", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryTimeline),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryTimeline, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryTimeline",
 			Tags:                []string{"rules"},
@@ -41,13 +50,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v2/rules/{id}/history/top_contributors", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryContributors),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryContributors, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryTopContributors",
 			Tags:                []string{"rules"},
@@ -58,13 +75,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v2/rules/{id}/history/filter_keys", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryFilterKeys),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryFilterKeys, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryFilterKeys",
 			Tags:                []string{"rules"},
@@ -75,13 +100,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v2/rules/{id}/history/filter_values", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryFilterValues),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryFilterValues, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryFilterValues",
 			Tags:                []string{"rules"},
@@ -92,13 +125,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v2/rules/{id}/history/overall_status", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryOverallStatus),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryOverallStatus, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryOverallStatus",
 			Tags:                []string{"rules"},
@@ -109,8 +150,16 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

--- a/pkg/http/handler/openapi.go
+++ b/pkg/http/handler/openapi.go
@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"reflect"

+	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 	"github.com/swaggest/jsonschema-go"
@@ -64,6 +65,13 @@ type OpenAPISecurityScheme struct {
 	Scopes []string
 }

+func NewScopedSecuritySchemes(scopes []string) []OpenAPISecurityScheme {
+	return []OpenAPISecurityScheme{
+		{Name: authtypes.IdentNProviderAPIKey.StringValue(), Scopes: scopes},
+		{Name: authtypes.IdentNProviderTokenizer.StringValue(), Scopes: scopes},
+	}
+}
+
 // OpenAPICollector is a collector for OpenAPI operations.
 type OpenAPICollector struct {
 	collector   *openapi.Collector
--- a/pkg/query-service/app/http_handler.go
+++ b/pkg/query-service/app/http_handler.go
@@ -28,6 +28,7 @@ import (

 	"github.com/prometheus/prometheus/promql"

+	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/http/middleware"
 	"github.com/SigNoz/signoz/pkg/http/render"
 	"github.com/SigNoz/signoz/pkg/query-service/app/integrations"
@@ -57,6 +58,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/query-service/postprocess"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/ctxtypes"
 	"github.com/SigNoz/signoz/pkg/types/featuretypes"
 	"github.com/SigNoz/signoz/pkg/types/instrumentationtypes"
@@ -72,6 +74,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/query-service/interfaces"
 	"github.com/SigNoz/signoz/pkg/query-service/model"
 	"github.com/SigNoz/signoz/pkg/ruler"
+	"github.com/SigNoz/signoz/pkg/ruler/rulerauthz"
 	"github.com/SigNoz/signoz/pkg/version"
 )

@@ -358,22 +361,271 @@ func (aH *APIHandler) Respond(w http.ResponseWriter, data interface{}) {
 	writeHttpResponse(w, data)
 }

+func newRuleHistoryV1OpenAPIDef(id string) handler.OpenAPIDef {
+	return handler.OpenAPIDef{
+		ID:                id,
+		Tags:              []string{"rules"},
+		Summary:           "Get rule history (v1, deprecated)",
+		Description:       "Deprecated legacy endpoint. Use the v2 rule history routes.",
+		SuccessStatusCode: http.StatusOK,
+		Deprecated:        true,
+		SecuritySchemes:   handler.NewScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+	}
+}
+
+func newRuleHistoryV1ResourceDefs() handler.Option {
+	return handler.WithResourceDefs(handler.BasicResourceDef{
+		Resource: coretypes.ResourceMetaResourceRule,
+		Verb:     coretypes.VerbRead,
+		Category: coretypes.ActionCategoryDataAccess,
+		ID:       coretypes.PathParam("id"),
+		Selector: coretypes.IDSelector,
+	})
+}
+
 // RegisterRoutes registers routes for this handler on the given router
 func (aH *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 	router.HandleFunc("/api/v1/query_range", am.ViewAccess(aH.queryRangeMetrics)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/query", am.ViewAccess(aH.queryMetrics)).Methods(http.MethodGet)

-	router.HandleFunc("/api/v1/rules", am.ViewAccess(aH.listRules)).Methods(http.MethodGet)
-	router.HandleFunc("/api/v1/rules/{id}", am.ViewAccess(aH.getRule)).Methods(http.MethodGet)
-	router.HandleFunc("/api/v1/rules", am.EditAccess(aH.createRule)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/rules/{id}", am.EditAccess(aH.editRule)).Methods(http.MethodPut)
-	router.HandleFunc("/api/v1/rules/{id}", am.EditAccess(aH.deleteRule)).Methods(http.MethodDelete)
-	router.HandleFunc("/api/v1/rules/{id}", am.EditAccess(aH.patchRule)).Methods(http.MethodPatch)
-	router.HandleFunc("/api/v1/testRule", am.EditAccess(aH.testRule)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/rules/{id}/history/stats", am.ViewAccess(aH.getRuleStats)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/rules/{id}/history/timeline", am.ViewAccess(aH.getRuleStateHistory)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/rules/{id}/history/top_contributors", am.ViewAccess(aH.getRuleStateHistoryTopContributors)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/rules/{id}/history/overall_status", am.ViewAccess(aH.getOverallStateTransitions)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules", handler.New(
+		am.CheckResources(aH.listRules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                "ListRulesV1",
+			Tags:              []string{"rules"},
+			Summary:           "List alert rules (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use ListRulesV3.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes:   handler.NewScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet)
+	router.Handle("/api/v1/rules/{id}", handler.New(
+		am.CheckResources(aH.getRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                "GetRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Get alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use GetRuleByID.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes:   handler.NewScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet)
+	router.Handle("/api/v1/rules", handler.New(
+		am.CheckResources(aH.createRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "CreateRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Create alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use CreateRule.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes: handler.NewScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewCreateChannelAttachExtractor(aH.Signoz.Alertmanager),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules/{id}", handler.New(
+		am.CheckResources(aH.editRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "UpdateRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Update alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use UpdateRuleByID.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes: handler.NewScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewReplaceChannelAttachExtractor(aH.Signoz.Alertmanager, aH.ruleManager),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewReplaceChannelDetachExtractor(aH.Signoz.Alertmanager, aH.ruleManager),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPut)
+	router.Handle("/api/v1/rules/{id}", handler.New(
+		am.CheckResources(aH.deleteRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Delete alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use DeleteRuleByID.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes:   handler.NewScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete)
+	router.Handle("/api/v1/rules/{id}", handler.New(
+		am.CheckResources(aH.patchRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "PatchRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Patch alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use PatchRuleByID.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes: handler.NewScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewPatchChannelAttachExtractor(aH.Signoz.Alertmanager, aH.ruleManager),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewPatchChannelDetachExtractor(aH.Signoz.Alertmanager, aH.ruleManager),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPatch)
+	router.Handle("/api/v1/testRule", handler.New(
+		am.CheckResources(aH.testRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "TestRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Test alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use TestRule.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes: handler.NewScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      rulerauthz.NewCreateChannelAttachExtractor(aH.Signoz.Alertmanager),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules/{id}/history/stats", handler.New(
+		am.CheckResources(aH.getRuleStats, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		newRuleHistoryV1OpenAPIDef("GetRuleHistoryStatsV1"),
+		newRuleHistoryV1ResourceDefs(),
+	)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules/{id}/history/timeline", handler.New(
+		am.CheckResources(aH.getRuleStateHistory, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		newRuleHistoryV1OpenAPIDef("GetRuleHistoryTimelineV1"),
+		newRuleHistoryV1ResourceDefs(),
+	)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules/{id}/history/top_contributors", handler.New(
+		am.CheckResources(aH.getRuleStateHistoryTopContributors, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		newRuleHistoryV1OpenAPIDef("GetRuleHistoryTopContributorsV1"),
+		newRuleHistoryV1ResourceDefs(),
+	)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules/{id}/history/overall_status", handler.New(
+		am.CheckResources(aH.getOverallStateTransitions, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		newRuleHistoryV1OpenAPIDef("GetRuleHistoryOverallStatusV1"),
+		newRuleHistoryV1ResourceDefs(),
+	)).Methods(http.MethodPost)

 	router.HandleFunc("/api/v2/variables/query", am.ViewAccess(aH.queryDashboardVarsV2)).Methods(http.MethodPost)

--- a/pkg/ruler/rulerauthz/channel.go
+++ b/pkg/ruler/rulerauthz/channel.go
@@ -0,0 +1,171 @@
+package rulerauthz
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/SigNoz/signoz/pkg/alertmanager"
+	"github.com/SigNoz/signoz/pkg/ruler"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/types/ruletypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/gorilla/mux"
+)
+
+func NewCreateChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		ctx := ec.Request.Context()
+		orgID, err := orgIDFromContext(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		names, err := channelsFromBody(ec.RequestBody)
+		if err != nil {
+			return nil, err
+		}
+
+		return resolveChannelIDs(ctx, alertmanagerService, orgID, names)
+	}}
+}
+
+func NewReplaceChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService ruler.Ruler) coretypes.ResourceIDsExtractor {
+	return newChannelDiffExtractor(alertmanagerService, rulerService, replacedChannels, attachedSide)
+}
+
+func NewReplaceChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService ruler.Ruler) coretypes.ResourceIDsExtractor {
+	return newChannelDiffExtractor(alertmanagerService, rulerService, replacedChannels, detachedSide)
+}
+
+func NewPatchChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService ruler.Ruler) coretypes.ResourceIDsExtractor {
+	return newChannelDiffExtractor(alertmanagerService, rulerService, patchedChannels, attachedSide)
+}
+
+func NewPatchChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService ruler.Ruler) coretypes.ResourceIDsExtractor {
+	return newChannelDiffExtractor(alertmanagerService, rulerService, patchedChannels, detachedSide)
+}
+
+const (
+	attachedSide diffSide = iota
+	detachedSide
+)
+
+type diffSide int
+
+type incomingChannelsFunc func(stored *ruletypes.GettableRule, body []byte) ([]string, error)
+
+func newChannelDiffExtractor(alertmanagerService alertmanager.Alertmanager, rulerService ruler.Ruler, incoming incomingChannelsFunc, side diffSide) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		ctx := ec.Request.Context()
+		orgID, err := orgIDFromContext(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		ruleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return nil, err
+		}
+
+		stored, err := rulerService.GetRule(ctx, ruleID)
+		if err != nil {
+			return nil, err
+		}
+
+		storedNames := stored.Channels()
+		incomingNames, err := incoming(stored, ec.RequestBody)
+		if err != nil {
+			return nil, err
+		}
+
+		attached, detached := coretypes.DiffLinks(storedNames, incomingNames)
+		if side == detachedSide {
+			return resolveChannelIDs(ctx, alertmanagerService, orgID, detached)
+		}
+
+		return resolveChannelIDs(ctx, alertmanagerService, orgID, attached)
+	}}
+}
+
+func replacedChannels(_ *ruletypes.GettableRule, body []byte) ([]string, error) {
+	return channelsFromBody(body)
+}
+
+func patchedChannels(stored *ruletypes.GettableRule, body []byte) ([]string, error) {
+	patched, err := clonePostableRule(stored.PostableRule)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := json.Unmarshal(body, patched); err != nil {
+		return nil, err
+	}
+
+	return patched.Channels(), nil
+}
+
+func clonePostableRule(rule ruletypes.PostableRule) (*ruletypes.PostableRule, error) {
+	encoded, err := json.Marshal(rule)
+	if err != nil {
+		return nil, err
+	}
+
+	clone := new(ruletypes.PostableRule)
+	if err := json.Unmarshal(encoded, clone); err != nil {
+		return nil, err
+	}
+
+	return clone, nil
+}
+
+func channelsFromBody(body []byte) ([]string, error) {
+	rule := new(ruletypes.PostableRule)
+	if err := json.Unmarshal(body, rule); err != nil {
+		return nil, err
+	}
+
+	return rule.Channels(), nil
+}
+
+func resolveChannelIDs(ctx context.Context, alertmanagerService alertmanager.Alertmanager, orgID valuer.UUID, names []string) ([]string, error) {
+	if len(names) == 0 {
+		return nil, nil
+	}
+
+	channels, err := alertmanagerService.ListChannels(ctx, orgID.StringValue())
+	if err != nil {
+		return nil, err
+	}
+
+	idByName := make(map[string]string, len(channels))
+	for _, channel := range channels {
+		idByName[channel.DisplayName] = channel.ID.StringValue()
+	}
+
+	ids := make([]string, 0, len(names))
+	for _, name := range names {
+		if id, ok := idByName[name]; ok {
+			ids = append(ids, id)
+		}
+	}
+
+	return ids, nil
+}
+
+func orgIDFromContext(ctx context.Context) (valuer.UUID, error) {
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		return valuer.UUID{}, err
+	}
+
+	return valuer.NewUUID(claims.OrgID)
+}
--- a/pkg/ruler/rulerauthz/channel_test.go
+++ b/pkg/ruler/rulerauthz/channel_test.go
@@ -0,0 +1,174 @@
+package rulerauthz
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/ruletypes"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func v1RuleJSON(preferredChannels string) string {
+	return `{
+		"alert": "TestAlert",
+		"version": "v5",
+		"condition": {
+			"compositeQuery": {
+				"queryType": "builder",
+				"queries": [{
+					"type": "builder_query",
+					"spec": {
+						"name": "A",
+						"signal": "metrics",
+						"aggregations": [{"metricName": "cpu", "spaceAggregation": "p50"}],
+						"stepInterval": "5m"
+					}
+				}]
+			},
+			"target": 10.0,
+			"matchType": "1",
+			"op": "1"
+		}` + preferredChannels + `
+	}`
+}
+
+func v2RuleJSON(channels string) string {
+	return `{
+		"alert": "TestAlert",
+		"version": "v5",
+		"schemaVersion": "v2alpha1",
+		"ruleType": "threshold_rule",
+		"condition": {
+			"compositeQuery": {
+				"queryType": "builder",
+				"queries": [{
+					"type": "builder_query",
+					"spec": {
+						"name": "A",
+						"signal": "metrics",
+						"aggregations": [{"metricName": "cpu", "spaceAggregation": "p50"}],
+						"stepInterval": "5m"
+					}
+				}]
+			},
+			"thresholds": {
+				"kind": "basic",
+				"spec": [{"name": "critical", "target": 90.0, "matchType": "1", "op": "1", "channels": ` + channels + `}]
+			}
+		},
+		"evaluation": {
+			"kind": "rolling",
+			"spec": {"evalWindow": "5m", "frequency": "1m"}
+		},
+		"notificationSettings": {
+			"renotify": {"enabled": true, "interval": "4h", "alertStates": ["firing"]}
+		}
+	}`
+}
+
+func TestChannelsFromBody(t *testing.T) {
+	testCases := []struct {
+		name         string
+		body         string
+		wantChannels []string
+		wantErr      bool
+	}{
+		{
+			name:         "V1PreferredChannels_FoldedIntoThresholds",
+			body:         v1RuleJSON(`, "preferredChannels": ["slack", "pager"]`),
+			wantChannels: []string{"slack", "pager"},
+		},
+		{
+			name:         "V1NoChannels_Empty",
+			body:         v1RuleJSON(""),
+			wantChannels: nil,
+		},
+		{
+			name:         "V2ThresholdChannels_ReadDirectly",
+			body:         v2RuleJSON(`["email"]`),
+			wantChannels: []string{"email"},
+		},
+		{
+			name:         "V2EmptyChannels_Empty",
+			body:         v2RuleJSON(`[]`),
+			wantChannels: nil,
+		},
+		{
+			name:    "NotJSON_Errors",
+			body:    "not json",
+			wantErr: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			channels, err := channelsFromBody([]byte(testCase.body))
+
+			if testCase.wantErr {
+				assert.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, testCase.wantChannels, channels)
+		})
+	}
+}
+
+func TestIncomingChannels(t *testing.T) {
+	testCases := []struct {
+		name            string
+		incoming        incomingChannelsFunc
+		stored          string
+		body            string
+		wantChannels    []string
+		wantStoredAfter []string
+	}{
+		{
+			name:            "Replaced_IgnoresStored",
+			incoming:        replacedChannels,
+			stored:          v2RuleJSON(`["slack"]`),
+			body:            v2RuleJSON(`["pager"]`),
+			wantChannels:    []string{"pager"},
+			wantStoredAfter: []string{"slack"},
+		},
+		{
+			name:            "Patched_OmitsCondition_StoredChannelsSurvive",
+			incoming:        patchedChannels,
+			stored:          v2RuleJSON(`["slack"]`),
+			body:            `{"disabled": true}`,
+			wantChannels:    []string{"slack"},
+			wantStoredAfter: []string{"slack"},
+		},
+		{
+			name:            "Patched_SetsChannels_StoredChannelsReplaced",
+			incoming:        patchedChannels,
+			stored:          v2RuleJSON(`["slack"]`),
+			body:            v2RuleJSON(`["pager"]`),
+			wantChannels:    []string{"pager"},
+			wantStoredAfter: []string{"slack"},
+		},
+		{
+			name:            "Patched_EmptiesChannels_NoChannelsLeft",
+			incoming:        patchedChannels,
+			stored:          v2RuleJSON(`["slack"]`),
+			body:            v2RuleJSON(`[]`),
+			wantChannels:    nil,
+			wantStoredAfter: []string{"slack"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			stored := new(ruletypes.GettableRule)
+			require.NoError(t, json.Unmarshal([]byte(testCase.stored), &stored.PostableRule))
+
+			channels, err := testCase.incoming(stored, []byte(testCase.body))
+
+			require.NoError(t, err)
+			assert.Equal(t, testCase.wantChannels, channels)
+			assert.Equal(t, testCase.wantStoredAfter, stored.Channels())
+		})
+	}
+}
--- a/pkg/ruler/rulerauthz/downtime.go
+++ b/pkg/ruler/rulerauthz/downtime.go
@@ -0,0 +1,48 @@
+package rulerauthz
+
+import (
+	"github.com/SigNoz/signoz/pkg/ruler"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/gorilla/mux"
+)
+
+var DowntimeRuleIDsExtractor = coretypes.BodyJSONArray("alertIds")
+
+func NewDowntimeRuleAttachExtractor(rulerService ruler.Ruler) coretypes.ResourceIDsExtractor {
+	return newDowntimeDiffExtractor(rulerService, attachedSide)
+}
+
+func NewDowntimeRuleDetachExtractor(rulerService ruler.Ruler) coretypes.ResourceIDsExtractor {
+	return newDowntimeDiffExtractor(rulerService, detachedSide)
+}
+
+func newDowntimeDiffExtractor(rulerService ruler.Ruler, side diffSide) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		scheduleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return nil, err
+		}
+
+		stored, err := rulerService.MaintenanceStore().GetPlannedMaintenanceByID(ec.Request.Context(), scheduleID)
+		if err != nil {
+			return nil, err
+		}
+
+		incoming, err := DowntimeRuleIDsExtractor.Fn(ec)
+		if err != nil {
+			return nil, err
+		}
+
+		attached, detached := coretypes.DiffLinks(stored.RuleIDs, incoming)
+		if side == detachedSide {
+			return detached, nil
+		}
+
+		return attached, nil
+	}}
+}
--- a/pkg/ruler/rulerauthz/route_policy.go
+++ b/pkg/ruler/rulerauthz/route_policy.go
@@ -0,0 +1,79 @@
+package rulerauthz
+
+import (
+	"encoding/json"
+
+	"github.com/SigNoz/signoz/pkg/alertmanager"
+	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/gorilla/mux"
+)
+
+func NewCreateRoutePolicyChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		ctx := ec.Request.Context()
+		orgID, err := orgIDFromContext(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		names, err := routePolicyChannelsFromBody(ec.RequestBody)
+		if err != nil {
+			return nil, err
+		}
+
+		return resolveChannelIDs(ctx, alertmanagerService, orgID, names)
+	}}
+}
+
+func NewUpdateRoutePolicyChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
+	return newRoutePolicyDiffExtractor(alertmanagerService, attachedSide)
+}
+
+func NewUpdateRoutePolicyChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
+	return newRoutePolicyDiffExtractor(alertmanagerService, detachedSide)
+}
+
+func newRoutePolicyDiffExtractor(alertmanagerService alertmanager.Alertmanager, side diffSide) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		ctx := ec.Request.Context()
+		orgID, err := orgIDFromContext(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		stored, err := alertmanagerService.GetRoutePolicyByID(ctx, mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return nil, err
+		}
+
+		incoming, err := routePolicyChannelsFromBody(ec.RequestBody)
+		if err != nil {
+			return nil, err
+		}
+
+		attached, detached := coretypes.DiffLinks(stored.Channels, incoming)
+		if side == detachedSide {
+			return resolveChannelIDs(ctx, alertmanagerService, orgID, detached)
+		}
+
+		return resolveChannelIDs(ctx, alertmanagerService, orgID, attached)
+	}}
+}
+
+func routePolicyChannelsFromBody(body []byte) ([]string, error) {
+	policy := new(alertmanagertypes.PostableRoutePolicy)
+	if err := json.Unmarshal(body, policy); err != nil {
+		return nil, err
+	}
+
+	return policy.Channels, nil
+}
--- a/pkg/signoz/openapi.go
+++ b/pkg/signoz/openapi.go
@@ -100,10 +100,12 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ rulestatehistory.Handler }{},
 		struct{ spanmapper.Handler }{},
 		struct{ alertmanager.Handler }{},
+		struct{ alertmanager.Alertmanager }{},
 		struct{ prometheus.Handler }{},
 		struct{ llmpricingrule.Handler }{},
 		struct{ tracedetail.Handler }{},
 		struct{ ruler.Handler }{},
+		struct{ ruler.Ruler }{},
 		struct{ statsreporter.Handler }{},
 		struct{ savedview.Handler }{},
 		global.Config{},
--- a/pkg/signoz/provider.go
+++ b/pkg/signoz/provider.go
@@ -48,6 +48,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/prometheus/clickhouseprometheusv2"
 	"github.com/SigNoz/signoz/pkg/querier"
 	"github.com/SigNoz/signoz/pkg/querier/signozquerier"
+	"github.com/SigNoz/signoz/pkg/ruler"
 	"github.com/SigNoz/signoz/pkg/sharder"
 	"github.com/SigNoz/signoz/pkg/sharder/noopsharder"
 	"github.com/SigNoz/signoz/pkg/sharder/singlesharder"
@@ -262,6 +263,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddRuleViewFactory(sqlstore, sqlschema),
 		sqlmigration.NewAddFieldTuplesFactory(sqlstore),
 		sqlmigration.NewKeepRelevantLLMPricingRulesFactory(),
+		sqlmigration.NewAddAlertTuplesFactory(sqlstore),
 	)
 }

@@ -326,7 +328,7 @@ func NewQuerierProviderFactories(telemetryStore telemetrystore.TelemetryStore, p
 	)
 }

-func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway, identNResolver identn.IdentNResolver, sharder sharder.Sharder, auditor auditor.Auditor, web web.Web) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
+func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway, identNResolver identn.IdentNResolver, sharder sharder.Sharder, auditor auditor.Auditor, web web.Web, alertmanagerService alertmanager.Alertmanager, rulerService ruler.Ruler) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
 	return factory.MustNewNamedMap(
 		signozapiserver.NewFactory(
 			orgGetter,
@@ -363,10 +365,12 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.RuleStateHistory,
 			handlers.SpanMapperHandler,
 			handlers.AlertmanagerHandler,
+			alertmanagerService,
 			handlers.PrometheusHandler,
 			handlers.LLMPricingRuleHandler,
 			handlers.TraceDetail,
 			handlers.RulerHandler,
+			rulerService,
 			handlers.StatsHandler,
 			handlers.SavedView,
 			globalConfig,
--- a/pkg/signoz/provider_test.go
+++ b/pkg/signoz/provider_test.go
@@ -106,6 +106,8 @@ func TestNewProviderFactories(t *testing.T) {
 			nil,
 			nil,
 			nil,
+			nil,
+			nil,
 		)
 	})
 }
--- a/pkg/signoz/signoz.go
+++ b/pkg/signoz/signoz.go
@@ -622,7 +622,7 @@ func New(
 		ctx,
 		providerSettings,
 		config.APIServer,
-		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway, identNResolver, sharder, auditor, web),
+		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway, identNResolver, sharder, auditor, web, alertmanager, rulerInstance),
 		"signoz",
 	)
 	if err != nil {
--- a/pkg/sqlmigration/136_add_alert_tuples.go
+++ b/pkg/sqlmigration/136_add_alert_tuples.go
@@ -0,0 +1,192 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addAlertTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddAlertTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_alert_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addAlertTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addAlertTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addAlertTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	writeVerbs := []string{"create", "read", "update", "delete", "list"}
+	readVerbs := []string{"read", "list"}
+	linkVerbs := []string{"attach", "detach"}
+
+	tuples := make([]migrationTuple, 0, 47)
+	for _, objectName := range []string{"rule", "planned-maintenance"} {
+		for _, verb := range writeVerbs {
+			tuples = append(tuples,
+				migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", objectName, verb},
+				migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", objectName, verb},
+			)
+		}
+		for _, verb := range linkVerbs {
+			tuples = append(tuples,
+				migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", objectName, verb},
+				migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", objectName, verb},
+			)
+		}
+		for _, verb := range readVerbs {
+			tuples = append(tuples, migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", objectName, verb})
+		}
+	}
+	for _, verb := range writeVerbs {
+		tuples = append(tuples, migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "route-policy", verb})
+	}
+	for _, verb := range linkVerbs {
+		tuples = append(tuples, migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "route-policy", verb})
+	}
+	for _, verb := range readVerbs {
+		tuples = append(tuples,
+			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "route-policy", verb},
+			migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "route-policy", verb},
+		)
+	}
+	for _, verb := range linkVerbs {
+		tuples = append(tuples,
+			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "notification-channel", verb},
+			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "notification-channel", verb},
+		)
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
+	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
+		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
+		if err != nil {
+			return err
+		}
+		managedRoleGroups[roleName] = string(data)
+	}
+
+	for _, orgID := range orgIDs {
+		for roleName, data := range managedRoleGroups {
+			if _, err := tx.NewUpdate().
+				Model(new(roles)).
+				Set("transaction_groups = ?", data).
+				Where("org_id = ?", orgID).
+				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
+				Where("name = ?", roleName).
+				Exec(ctx); err != nil {
+				return err
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addAlertTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}
--- a/pkg/types/coretypes/link.go
+++ b/pkg/types/coretypes/link.go
@@ -0,0 +1,41 @@
+package coretypes
+
+func DiffLinks(stored, incoming []string) (attached, detached []string) {
+	storedSet := make(map[string]struct{}, len(stored))
+	for _, id := range stored {
+		storedSet[id] = struct{}{}
+	}
+
+	incomingSet := make(map[string]struct{}, len(incoming))
+	for _, id := range incoming {
+		incomingSet[id] = struct{}{}
+	}
+
+	seen := make(map[string]struct{}, len(incoming))
+	attached = make([]string, 0, len(incoming))
+	for _, id := range incoming {
+		if _, ok := storedSet[id]; ok {
+			continue
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		attached = append(attached, id)
+	}
+
+	clear(seen)
+	detached = make([]string, 0, len(stored))
+	for _, id := range stored {
+		if _, ok := incomingSet[id]; ok {
+			continue
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		detached = append(detached, id)
+	}
+
+	return attached, detached
+}
--- a/pkg/types/coretypes/link_test.go
+++ b/pkg/types/coretypes/link_test.go
@@ -0,0 +1,77 @@
+package coretypes
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDiffLinks(t *testing.T) {
+	testCases := []struct {
+		name         string
+		stored       []string
+		incoming     []string
+		wantAttached []string
+		wantDetached []string
+	}{
+		{
+			name:         "BothEmpty_NothingChanges",
+			wantAttached: []string{},
+			wantDetached: []string{},
+		},
+		{
+			name:         "NoStored_EverythingAttaches",
+			incoming:     []string{"slack", "pager"},
+			wantAttached: []string{"slack", "pager"},
+			wantDetached: []string{},
+		},
+		{
+			name:         "NoIncoming_EverythingDetaches",
+			stored:       []string{"slack", "pager"},
+			wantAttached: []string{},
+			wantDetached: []string{"slack", "pager"},
+		},
+		{
+			name:         "Unchanged_NothingChanges",
+			stored:       []string{"slack", "pager"},
+			incoming:     []string{"pager", "slack"},
+			wantAttached: []string{},
+			wantDetached: []string{},
+		},
+		{
+			name:         "OneAddedOneRemoved_BothSidesReported",
+			stored:       []string{"slack", "pager"},
+			incoming:     []string{"slack", "email"},
+			wantAttached: []string{"email"},
+			wantDetached: []string{"pager"},
+		},
+		{
+			name:         "DuplicateIncoming_CollapsedOnce",
+			incoming:     []string{"slack", "slack"},
+			wantAttached: []string{"slack"},
+			wantDetached: []string{},
+		},
+		{
+			name:         "DuplicateStored_CollapsedOnce",
+			stored:       []string{"pager", "pager"},
+			wantAttached: []string{},
+			wantDetached: []string{"pager"},
+		},
+		{
+			name:         "IncomingOrderPreserved",
+			stored:       []string{"keep"},
+			incoming:     []string{"zebra", "keep", "apple"},
+			wantAttached: []string{"zebra", "apple"},
+			wantDetached: []string{},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			attached, detached := DiffLinks(testCase.stored, testCase.incoming)
+
+			assert.Equal(t, testCase.wantAttached, attached)
+			assert.Equal(t, testCase.wantDetached, detached)
+		})
+	}
+}
--- a/pkg/types/coretypes/registry_managed_role.go
+++ b/pkg/types/coretypes/registry_managed_role.go
@@ -134,12 +134,16 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		// rule — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		// saved-view — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
@@ -172,12 +176,16 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		// route-policy — admin writes, viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		// apdex-setting — admin updates, viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindApdexSetting}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindApdexSetting}, WildCardSelectorString)},
@@ -237,12 +245,16 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		// rule — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		// saved-view — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
@@ -278,6 +290,8 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// notification-channel — read only (admin writes)
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		// route-policy — read only (admin writes)
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
--- a/pkg/types/coretypes/registry_resource.go
+++ b/pkg/types/coretypes/registry_resource.go
@@ -47,8 +47,8 @@ var (
 	ResourceRole                                         = NewResourceRole()
 	ResourceServiceAccount                               = NewResourceServiceAccount()
 	ResourceUser                                         = NewResourceUser()
-	ResourceMetaResourceNotificationChannel              = NewResourceMetaResource(KindNotificationChannel, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
-	ResourceMetaResourceRoutePolicy                      = NewResourceMetaResource(KindRoutePolicy)
+	ResourceMetaResourceNotificationChannel              = NewResourceMetaResource(KindNotificationChannel, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete, VerbAttach, VerbDetach)
+	ResourceMetaResourceRoutePolicy                      = NewResourceMetaResource(KindRoutePolicy, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete, VerbAttach, VerbDetach)
 	ResourceMetaResourceApdexSetting                     = NewResourceMetaResource(KindApdexSetting)
 	ResourceMetaResourceAuthDomain                       = NewResourceMetaResource(KindAuthDomain)
 	ResourceMetaResourceSession                          = NewResourceMetaResource(KindSession)
@@ -64,8 +64,8 @@ var (
 	ResourceMetaResourceOrgPreference                    = NewResourceMetaResource(KindOrgPreference)
 	ResourceMetaResourceQuickFilter                      = NewResourceMetaResource(KindQuickFilter, VerbList, VerbRead, VerbUpdate)
 	ResourceMetaResourceTTLSetting                       = NewResourceMetaResource(KindTTLSetting)
-	ResourceMetaResourceRule                             = NewResourceMetaResource(KindRule)
-	ResourceMetaResourcePlannedMaintenance               = NewResourceMetaResource(KindPlannedMaintenance)
+	ResourceMetaResourceRule                             = NewResourceMetaResource(KindRule, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete, VerbAttach, VerbDetach)
+	ResourceMetaResourcePlannedMaintenance               = NewResourceMetaResource(KindPlannedMaintenance, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete, VerbAttach, VerbDetach)
 	ResourceMetaResourceSavedView                        = NewResourceMetaResource(KindSavedView, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourceTraceFunnel                      = NewResourceMetaResource(KindTraceFunnel)
 	ResourceMetaResourceFactorPassword                   = NewResourceMetaResource(KindFactorPassword)
--- a/tests/integration/testdata/role/managed_role_transactions.json
+++ b/tests/integration/testdata/role/managed_role_transactions.json
@@ -188,7 +188,9 @@
        "read",
        "update",
        "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
      ]
    },
    {
@@ -199,7 +201,9 @@
        "read",
        "update",
        "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
      ]
    },
    {
@@ -256,7 +260,9 @@
        "read",
        "update",
        "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
      ]
    },
    {
@@ -267,7 +273,9 @@
        "read",
        "update",
        "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
      ]
    },
    {
@@ -407,7 +415,9 @@
        "read",
        "update",
        "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
      ]
    },
    {
@@ -418,7 +428,9 @@
        "read",
        "update",
        "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
      ]
    },
    {
@@ -483,7 +495,9 @@
      "kind": "notification-channel",
      "verbs": [
        "read",
-        "list"
+        "list",
+        "attach",
+        "detach"
      ]
    },
    {
--- a/tests/integration/tests/ruler/07_authz.py
+++ b/tests/integration/tests/ruler/07_authz.py
@@ -0,0 +1,790 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    add_license,
+    change_user_role,
+    create_active_user,
+)
+from fixtures.role import find_role_by_name, transaction_group
+from fixtures.types import Operation, SigNoz, TestContainerDocker
+
+V1_RULES_URL = "/api/v1/rules"
+V2_RULES_URL = "/api/v2/rules"
+V3_RULES_URL = "/api/v3/rules"
+RULE_VIEWS_URL = "/api/v2/rule_views"
+DOWNTIME_URL = "/api/v1/downtime_schedules"
+ROUTE_POLICIES_URL = "/api/v1/route_policies"
+
+_EDITOR_EMAIL = "editor+alertauthz@integration.test"
+_EDITOR_PASSWORD = "password123Z$"
+_VIEWER_EMAIL = "viewer+alertauthz@integration.test"
+_VIEWER_PASSWORD = "password123Z$"
+
+_TARGET_RULE = "alert authz target"
+_EDITOR_RULE = "alert authz editor rule"
+_EDITOR_RULE_V1 = "alert authz editor rule v1"
+_ACTOR_EMAIL = "actor+alertauthz@integration.test"
+_ACTOR_PASSWORD = "password123Z$"
+_ACTOR_ROLE_NAME = "alert-authz-actor"
+_ACTOR_RULE = "alert authz actor rule"
+_ACTOR_SWAP_RULE = "alert authz actor swap rule"
+_ACTOR_DOWNTIME_NAME = "alert-authz-actor-downtime"
+_DOWNTIME_NAME = "alert-authz-downtime"
+_ROUTE_POLICY_NAME = "alert-authz-route-policy"
+_VIEW_NAME = "alert-authz-view"
+
+SEED_CHANNEL = {"name": "alert-authz-channel", "email_configs": [{"to": "alert-authz@integration.test"}]}
+SEED_CHANNEL_ALT = {"name": "alert-authz-channel-alt", "email_configs": [{"to": "alert-authz-alt@integration.test"}]}
+
+_ACTOR_BASE_TRANSACTION_GROUPS = [
+    transaction_group("create", "metaresource", "rule", ["*"]),
+    transaction_group("read", "metaresource", "rule", ["*"]),
+    transaction_group("list", "metaresource", "rule", ["*"]),
+    transaction_group("update", "metaresource", "rule", ["*"]),
+    transaction_group("delete", "metaresource", "rule", ["*"]),
+    transaction_group("attach", "metaresource", "rule", ["*"]),
+    transaction_group("create", "metaresource", "planned-maintenance", ["*"]),
+    transaction_group("read", "metaresource", "planned-maintenance", ["*"]),
+    transaction_group("list", "metaresource", "planned-maintenance", ["*"]),
+    transaction_group("update", "metaresource", "planned-maintenance", ["*"]),
+    transaction_group("attach", "metaresource", "planned-maintenance", ["*"]),
+]
+
+RULE_CONDITION = {
+    "thresholds": {
+        "kind": "basic",
+        "spec": [{"name": "critical", "target": 90, "matchType": "at_least_once", "op": "above", "channels": ["alert-authz-channel"]}],
+    },
+    "compositeQuery": {
+        "queryType": "builder",
+        "panelType": "graph",
+        "queries": [
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "metrics",
+                    "aggregations": [{"metricName": "alert_authz_cpu", "timeAggregation": "avg", "spaceAggregation": "max"}],
+                },
+            }
+        ],
+    },
+    "selectedQueryName": "A",
+}
+
+RULE_TEMPLATE = {
+    "description": "authz coverage rule",
+    "alertType": "METRIC_BASED_ALERT",
+    "ruleType": "threshold_rule",
+    "condition": RULE_CONDITION,
+    "labels": {"severity": "critical"},
+    "annotations": {"summary": "s", "description": "d"},
+    "evaluation": {"kind": "rolling", "spec": {"evalWindow": "5m0s", "frequency": "1m"}},
+    "notificationSettings": {"groupBy": [], "usePolicy": False, "renotify": {"enabled": False, "interval": "30m", "alertStates": []}},
+    "version": "v5",
+    "schemaVersion": "v2alpha1",
+}
+
+
+def test_setup_users_and_target(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_emails = {user["email"] for user in response.json()["data"]}
+
+    for email, role, password, name in (
+        (_EDITOR_EMAIL, "signoz-editor", _EDITOR_PASSWORD, "alert authz editor"),
+        (_VIEWER_EMAIL, "signoz-viewer", _VIEWER_PASSWORD, "alert authz viewer"),
+    ):
+        if email not in existing_emails:
+            create_active_user(signoz, admin_token, email=email, role=role, password=password, name=name)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/channels"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_channel_names = [channel["name"] for channel in response.json()["data"] or []]
+    for channel in (SEED_CHANNEL, SEED_CHANNEL_ALT):
+        if channel["name"] not in existing_channel_names:
+            response = requests.post(
+                signoz.self.host_configs["8080"].get("/api/v1/channels"),
+                json=channel,
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=5,
+            )
+            assert response.status_code == HTTPStatus.CREATED, response.text
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V3_RULES_URL}?limit=200"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {rule["alert"]: rule["id"] for rule in response.json()["data"]["rules"]}
+    for name in (_TARGET_RULE, _EDITOR_RULE, _EDITOR_RULE_V1, _ACTOR_SWAP_RULE):
+        if name in ids:
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{ids[name]}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=5,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_RULES_URL),
+        json={**RULE_TEMPLATE, "alert": _TARGET_RULE},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+
+
+def test_viewer_allowed_on_reads(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V3_RULES_URL}?limit=200"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {rule["alert"]: rule["id"] for rule in response.json()["data"]["rules"]}
+    target_id = ids[_TARGET_RULE]
+
+    for path in (
+        V2_RULES_URL,
+        f"{V2_RULES_URL}/{target_id}",
+        V1_RULES_URL,
+        f"{V1_RULES_URL}/{target_id}",
+        DOWNTIME_URL,
+        ROUTE_POLICIES_URL,
+    ):
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(path),
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, f"GET {path}: expected 200, got {response.status_code}: {response.text}"
+
+
+def test_viewer_allowed_on_rule_views(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(RULE_VIEWS_URL),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(RULE_VIEWS_URL),
+        json={"name": _VIEW_NAME, "data": {"version": "v1", "sort": "updated_at", "order": "desc"}},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    view_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{RULE_VIEWS_URL}/{view_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_viewer_forbidden_on_mutations(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V3_RULES_URL}?limit=200"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {rule["alert"]: rule["id"] for rule in response.json()["data"]["rules"]}
+    target_id = ids[_TARGET_RULE]
+
+    for method, path in (
+        ("post", V2_RULES_URL),
+        ("put", f"{V2_RULES_URL}/{target_id}"),
+        ("patch", f"{V2_RULES_URL}/{target_id}"),
+        ("delete", f"{V2_RULES_URL}/{target_id}"),
+        ("post", f"{V2_RULES_URL}/test"),
+        ("post", V1_RULES_URL),
+        ("put", f"{V1_RULES_URL}/{target_id}"),
+        ("patch", f"{V1_RULES_URL}/{target_id}"),
+        ("delete", f"{V1_RULES_URL}/{target_id}"),
+        ("post", "/api/v1/testRule"),
+        ("post", DOWNTIME_URL),
+        ("put", f"{DOWNTIME_URL}/{target_id}"),
+        ("delete", f"{DOWNTIME_URL}/{target_id}"),
+        ("post", ROUTE_POLICIES_URL),
+        ("put", f"{ROUTE_POLICIES_URL}/{target_id}"),
+        ("delete", f"{ROUTE_POLICIES_URL}/{target_id}"),
+    ):
+        response = getattr(requests, method)(
+            signoz.self.host_configs["8080"].get(path),
+            json={},
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.FORBIDDEN, f"{method.upper()} {path}: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_editor_allowed_on_rule_and_downtime_mutations(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_RULES_URL),
+        json={**RULE_TEMPLATE, "alert": _EDITOR_RULE},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    rule_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V1_RULES_URL),
+        json={**RULE_TEMPLATE, "alert": _EDITOR_RULE_V1},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    v1_rule_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V1_RULES_URL}/{v1_rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(DOWNTIME_URL),
+        json={
+            "name": _DOWNTIME_NAME,
+            "description": "authz coverage window",
+            "schedule": {"timezone": "UTC", "startTime": "2026-09-21T00:00:00Z", "endTime": "2026-09-22T00:00:00Z"},
+            "alertIds": [],
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    downtime_id = response.json()["data"]["id"]
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{downtime_id}"),
+        json={
+            "name": _DOWNTIME_NAME,
+            "description": "authz coverage window updated",
+            "schedule": {"timezone": "UTC", "startTime": "2026-09-21T00:00:00Z", "endTime": "2026-09-23T00:00:00Z"},
+            "alertIds": [],
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{downtime_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_editor_forbidden_on_route_policy_writes(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    for method, path in (
+        ("post", ROUTE_POLICIES_URL),
+        ("put", f"{ROUTE_POLICIES_URL}/00000000-0000-0000-0000-000000000000"),
+        ("delete", f"{ROUTE_POLICIES_URL}/00000000-0000-0000-0000-000000000000"),
+    ):
+        response = getattr(requests, method)(
+            signoz.self.host_configs["8080"].get(path),
+            json={},
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.FORBIDDEN, f"{method.upper()} {path}: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_admin_allowed_on_route_policy_writes(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(ROUTE_POLICIES_URL),
+        json={
+            "name": _ROUTE_POLICY_NAME,
+            "expression": 'threshold.name == "critical"',
+            "channels": ["alert-authz-channel"],
+            "description": "authz coverage policy",
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    policy_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{ROUTE_POLICIES_URL}/{policy_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_editor_allowed_on_downtime_naming_rules(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V3_RULES_URL}?limit=200"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_id = {rule["alert"]: rule["id"] for rule in response.json()["data"]["rules"]}[_TARGET_RULE]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(DOWNTIME_URL),
+        json={
+            "name": _DOWNTIME_NAME,
+            "description": "authz coverage window with rules",
+            "schedule": {"timezone": "UTC", "startTime": "2026-09-21T00:00:00Z", "endTime": "2026-09-22T00:00:00Z"},
+            "alertIds": [target_id],
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    downtime_id = response.json()["data"]["id"]
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{downtime_id}"),
+        json={
+            "name": _DOWNTIME_NAME,
+            "description": "authz coverage window without rules",
+            "schedule": {"timezone": "UTC", "startTime": "2026-09-21T00:00:00Z", "endTime": "2026-09-22T00:00:00Z"},
+            "alertIds": [],
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{downtime_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_editor_allowed_on_rule_channel_changes(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_RULES_URL),
+        json={**RULE_TEMPLATE, "alert": _EDITOR_RULE},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    rule_id = response.json()["data"]["id"]
+
+    swapped_condition = {
+        **RULE_CONDITION,
+        "thresholds": {
+            "kind": "basic",
+            "spec": [{"name": "critical", "target": 90, "matchType": "at_least_once", "op": "above", "channels": [SEED_CHANNEL_ALT["name"]]}],
+        },
+    }
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{rule_id}"),
+        json={**RULE_TEMPLATE, "alert": _EDITOR_RULE, "condition": swapped_condition},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.patch(
+        signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{rule_id}"),
+        json={"description": "patched without touching channels"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    assert response.json()["data"]["condition"]["thresholds"]["spec"][0]["channels"] == [SEED_CHANNEL_ALT["name"]], response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_apply_license(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    make_http_mocks: Callable[[TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+):
+    add_license(signoz, make_http_mocks, get_token)
+
+
+def test_setup_channel_scoped_actor(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/roles"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_role_ids = {role["name"]: role["id"] for role in response.json()["data"]}
+
+    if _ACTOR_ROLE_NAME in existing_role_ids:
+        response = requests.put(
+            signoz.self.host_configs["8080"].get(f"/api/v1/roles/{existing_role_ids[_ACTOR_ROLE_NAME]}"),
+            json={"description": "", "transactionGroups": _ACTOR_BASE_TRANSACTION_GROUPS},
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+    else:
+        create_role(admin_token, _ACTOR_ROLE_NAME, _ACTOR_BASE_TRANSACTION_GROUPS)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    if _ACTOR_EMAIL not in {user["email"] for user in response.json()["data"]}:
+        user_id = create_active_user(signoz, admin_token, email=_ACTOR_EMAIL, role="signoz-viewer", password=_ACTOR_PASSWORD, name="alert authz actor")
+        change_user_role(signoz, admin_token, user_id, "signoz-viewer", _ACTOR_ROLE_NAME)
+
+
+def test_rule_without_channels_allowed_without_channel_attach(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    condition = {
+        **RULE_CONDITION,
+        "thresholds": {"kind": "basic", "spec": [{"name": "critical", "target": 90, "matchType": "at_least_once", "op": "above", "channels": []}]},
+    }
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_RULES_URL),
+        json={
+            **RULE_TEMPLATE,
+            "alert": _ACTOR_RULE,
+            "condition": condition,
+            "notificationSettings": {**RULE_TEMPLATE["notificationSettings"], "usePolicy": True},
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{response.json()['data']['id']}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_rule_naming_channel_forbidden_without_channel_attach(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_RULES_URL),
+        json={**RULE_TEMPLATE, "alert": _ACTOR_RULE},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+
+
+def test_rule_naming_channel_allowed_once_channel_attach_granted(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, _ACTOR_ROLE_NAME)}"),
+        json={
+            "description": "",
+            "transactionGroups": _ACTOR_BASE_TRANSACTION_GROUPS + [transaction_group("attach", "metaresource", "notification-channel", ["*"])],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_RULES_URL),
+        json={**RULE_TEMPLATE, "alert": _ACTOR_RULE},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{response.json()['data']['id']}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_channel_swap_forbidden_without_channel_detach(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_RULES_URL),
+        json={**RULE_TEMPLATE, "alert": _ACTOR_SWAP_RULE},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    rule_id = response.json()["data"]["id"]
+
+    swapped_condition = {
+        **RULE_CONDITION,
+        "thresholds": {
+            "kind": "basic",
+            "spec": [{"name": "critical", "target": 90, "matchType": "at_least_once", "op": "above", "channels": [SEED_CHANNEL_ALT["name"]]}],
+        },
+    }
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{rule_id}"),
+        json={**RULE_TEMPLATE, "alert": _ACTOR_SWAP_RULE, "condition": swapped_condition},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+
+    response = requests.patch(
+        signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{rule_id}"),
+        json={"description": "patched without touching channels"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_downtime_rule_removal_forbidden_without_rule_detach(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V3_RULES_URL}?limit=200"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_id = {rule["alert"]: rule["id"] for rule in response.json()["data"]["rules"]}[_TARGET_RULE]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(DOWNTIME_URL),
+        json={
+            "name": _ACTOR_DOWNTIME_NAME,
+            "description": "scoped actor window",
+            "schedule": {"timezone": "UTC", "startTime": "2026-09-21T00:00:00Z", "endTime": "2026-09-22T00:00:00Z"},
+            "alertIds": [target_id],
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    downtime_id = response.json()["data"]["id"]
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{downtime_id}"),
+        json={
+            "name": _ACTOR_DOWNTIME_NAME,
+            "description": "scoped actor window without rules",
+            "schedule": {"timezone": "UTC", "startTime": "2026-09-21T00:00:00Z", "endTime": "2026-09-22T00:00:00Z"},
+            "alertIds": [],
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{downtime_id}"),
+        json={
+            "name": _ACTOR_DOWNTIME_NAME,
+            "description": "scoped actor window without rules",
+            "schedule": {"timezone": "UTC", "startTime": "2026-09-21T00:00:00Z", "endTime": "2026-09-22T00:00:00Z"},
+            "alertIds": [],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{downtime_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_alert_authz_cleanup(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(DOWNTIME_URL),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    for schedule in response.json()["data"] or []:
+        if schedule["name"] not in (_DOWNTIME_NAME, _ACTOR_DOWNTIME_NAME):
+            continue
+        response = requests.put(
+            signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{schedule['id']}"),
+            json={"name": schedule["name"], "description": schedule["description"], "schedule": schedule["schedule"], "alertIds": []},
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+        response = requests.delete(
+            signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{schedule['id']}"),
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V3_RULES_URL}?limit=200"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {rule["alert"]: rule["id"] for rule in response.json()["data"]["rules"]}
+    for name in (_TARGET_RULE, _EDITOR_RULE, _EDITOR_RULE_V1, _ACTOR_SWAP_RULE):
+        if name in ids:
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{ids[name]}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=5,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT, f"delete {name}: {response.text}"
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/channels"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    for channel in response.json()["data"] or []:
+        if channel["name"] in (SEED_CHANNEL["name"], SEED_CHANNEL_ALT["name"]):
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"/api/v1/channels/{channel['id']}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=5,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT, f"delete channel: {response.text}"
Author	SHA1	Message	Date
nikhilmantri0902	0565363083	test(authz): clear downtime rule links before deleting the schedule A schedule that still references rules cannot be deleted, so the teardown empties alertIds first. Admin doing that removal is also the allow half of the detach pair the scoped actor is refused.	2026-10-14 21:18:42 +05:30
nikhilmantri0902	c2f6ffb423	test(authz): prove the link diff is enforced, not just resolved The editor cases held every verb, so a swap passed whatever the extractors resolved. The scoped actor now holds attach without detach, which is the only grant shape that can tell the detach side apart. PATCH with just a description must stay 200: it proves patch semantics, since replace semantics would fail to parse a body with no condition.	2026-10-14 20:47:11 +05:30
nikhilmantri0902	b6208538bf	refactor(authz): address review on alert rule link checks newScopedSecuritySchemes moves to pkg/http/handler so the v1 router and the apiserver share one copy instead of twinning it. The patch clone is a named helper now, so the deep copy no longer needs a comment defending it.	2026-10-14 20:40:42 +05:30
nikhilmantri0902	db708385ad	chore: generate openapi specs	2026-10-14 19:49:15 +05:30
nikhilmantri0902	83b1b90f29	feat(authz): require attach and detach for alert rule links Rules and route policies name notification channels, downtime schedules name rules. Editing one of those is not the same right as linking it to a resource the caller has no rights over, so the writes now declare attach and detach alongside create and update. Update and patch check the diff: attach covers the links being added, detach the ones being removed, rather than the blanket detach over everything stored that auth domain update uses. Patch resolves the effective set by overlaying the body on the stored rule the way PatchRule itself does, so a body that leaves the condition alone triggers neither check. Editor holds only read and list on notification-channel, so it needs the attach grant to keep creating rules that name one.	2026-10-14 19:49:11 +05:30
nikhilmantri0902	47cf0847b1	chore: resolve conflicts merging main into alerts fga branch renumber alert tuples migration to 136, main took 135	2026-10-14 12:41:15 +05:30
nikhilmantri0902	685a02e72d	chore: resolved conflicts and merged main	2026-10-13 13:51:13 +05:30
nikhilmantri0902	b5fcd935a7	Merge branch 'main' into feat/alerts_rules_fga_setup # Conflicts: # docs/api/openapi.yml # pkg/apiserver/signozapiserver/ruler.go # pkg/signoz/provider.go	2026-10-06 17:36:01 +05:30
nikhilmantri0902	fa105e640c	Merge branch 'feat/alert_rule_views' into feat/alerts_rules_fga_setup # Conflicts: # pkg/apiserver/signozapiserver/ruler.go # pkg/types/coretypes/registry_resource.go # tests/integration/tests/ruler/08_authz.py	2026-10-06 08:43:18 +05:30
nikhilmantri0902	014e1fc86a	test(ruler): drop the create_rule_view fixture, the views suite owns its lifecycle	2026-10-05 16:40:57 +05:30
nikhilmantri0902	6d3fbb9903	chore(api): regenerate openapi spec and frontend client	2026-10-05 11:02:58 +05:30
nikhilmantri0902	758443f42a	refactor(ruletypes): collapse rule view flavors into a single RuleView Matches the dashboard view shape per the core-type-first convention: one base type doubles as the row and the response.	2026-10-05 11:02:57 +05:30
nikhilmantri0902	847eb52883	refactor(ruletypes): type the rule view data column as RuleViewData Drops the storage-only data struct and its mappers, matching the dashboard views shape; the storable and gettable row split stays.	2026-10-05 10:39:24 +05:30
nikhilmantri0902	17574db3dc	Merge branch 'main' into feat/alert_rule_views # Conflicts: # pkg/signoz/provider.go	2026-10-05 09:17:26 +05:30
nikhilmantri0902	34482d8cc1	refactor(ruletypes): type the rule view data column with a storage-owned struct	2026-09-28 11:18:31 +05:30
nikhilmantri0902	a541d2687c	Merge branch 'main' into feat/alert_rule_views # Conflicts: # docs/api/openapi.yml # tests/integration/tests/ruler/07_rule_views.py	2026-09-28 10:45:51 +05:30
nikhilmantri0902	6ab70762a7	fix(ruler): use a snake_case slog key for rule view decode errors	2026-09-24 13:42:12 +05:30
nikhilmantri0902	8989e0a3a1	chore(api): regenerate openapi spec and frontend client	2026-09-24 13:34:00 +05:30
nikhilmantri0902	0d150554c7	refactor(ruletypes): split rule view storage and wire shapes StorableRuleView and GettableRuleView meet only in converters; the list conversion is a pure types function with per-id errors the provider logs. Also renames test cases to the PascalCase convention, drops the dead ensure_notification_channel helper and restores the create_rule_view fixture lost in the main merge.	2026-09-24 13:34:00 +05:30
nikhilmantri0902	bee75c8e34	Merge branch 'main' into feat/alert_rule_views # Conflicts: # docs/api/openapi.yml # ee/sqlstore/postgressqlstore/formatter_test.go # frontend/src/api/generated/services/rules/index.ts # frontend/src/api/generated/services/sigNoz.schemas.ts # pkg/query-service/rules/manager.go # pkg/query-service/rules/manager_test.go # pkg/ruler/rulestore/rulestoretest/rule.go # pkg/ruler/rulestore/sqlrulestore/rule.go # pkg/signoz/provider.go # pkg/sqlstore/sqlitesqlstore/formatter_test.go # pkg/sqlstore/sqlstoretest/formatter_test.go # pkg/types/ruletypes/list.go # pkg/types/ruletypes/list_test.go # pkg/types/ruletypes/listable_rule_test.go # pkg/types/ruletypes/rule.go # tests/fixtures/alerts.py	2026-09-24 13:09:42 +05:30
Nikhil Mantri	eb54542ca1	Merge branch 'feat/alerts_listing_page_revamp' into feat/alert_rule_views	2026-09-22 12:17:03 +05:30
nikhilmantri0902	c92fe4969a	fix(ruletypes): rank nodata above pending in the state display order	2026-09-22 12:00:13 +05:30
nikhilmantri0902	97a2fefe61	Merge branch 'feat/alerts_listing_page_revamp' into feat/alert_rule_views # Conflicts: # pkg/signoz/provider.go # pkg/types/ruletypes/list.go # pkg/types/ruletypes/list_test.go	2026-09-22 11:32:54 +05:30
Nikhil Mantri	c059d3b8f6	Merge branch 'main' into feat/alerts_listing_page_revamp	2026-09-22 11:16:36 +05:30
nikhilmantri0902	37d342eb90	refactor(ruletypes): move the storable-to-listable loop into the types package	2026-09-22 11:16:08 +05:30
nikhilmantri0902	d60da7b8a7	docs(sqlrulestore): fix stale resolver comment on unknown keys	2026-09-22 11:03:52 +05:30
nikhilmantri0902	8d5111bc7d	refactor(ruletypes): rename storable-to-listable converter to ToListableRule method	2026-09-22 10:59:50 +05:30
nikhilmantri0902	e2578c15fb	revert(rules): drop the drive-by TriggeredAlerts read-lock fix	2026-09-21 16:59:07 +05:30
nikhilmantri0902	6c5016bdd9	test(integration): cover alerts authz across managed roles	2026-09-21 16:51:55 +05:30
nikhilmantri0902	3b13ae9681	chore: generate openapi specs	2026-09-21 16:51:55 +05:30
nikhilmantri0902	d55e4a7243	feat(sqlmigration): backfill rule, planned-maintenance and route-policy tuples	2026-09-21 16:51:54 +05:30
nikhilmantri0902	6ff779d5ab	feat(authz): move rules, downtime and route policy routes to FGA checks Covers v2/v3 rules, rule views, state history, legacy v1 rules routes (kept out of the OpenAPI spec by the generator), downtime schedules and route policies. Route policy writes stay admin-only, matching the previous AdminAccess gate.	2026-09-21 16:51:53 +05:30
Nikhil Mantri	a446a832ae	Merge branch 'main' into feat/alerts_listing_page_revamp	2026-09-21 16:48:30 +05:30
nikhilmantri0902	c89c19ce9e	chore(api): regenerate openapi spec and frontend client	2026-09-21 16:43:44 +05:30
nikhilmantri0902	e543b3ef32	feat(sqlrulestore): match bare label keys and both sides of reserved-key collisions A non-reserved key filters the rule labels directly. A key colliding with a reserved keyword matches either interpretation, with negative operators excluding both, mirroring the v5 querier's ambiguous-key semantics. labels.<key> stays the explicit label-only form.	2026-09-21 16:43:43 +05:30
nikhilmantri0902	3f7531f444	refactor(ruletypes): co-locate state display rank with severity and pin exhaustiveness	2026-09-21 14:30:32 +05:30
nikhilmantri0902	abfa9bee1e	fix(rules): validate list params in the manager for non-API callers	2026-09-21 14:13:27 +05:30
nikhilmantri0902	2f497108df	fix(ruletypes): lower rules list max page size to 200	2026-09-21 13:54:44 +05:30
nikhilmantri0902	1fa1e292e9	test(sqlstore): cover JSONExtractMapValue in sqlite, postgres and test formatters	2026-09-21 13:47:25 +05:30
nikhilmantri0902	a328988a15	chore: alertStates -> GetAlertStates	2026-09-21 13:28:45 +05:30
nikhilmantri0902	7e53bd607d	chore: added ruletypes layer in between structs	2026-09-21 13:26:23 +05:30
Nikhil Mantri	4d82eb8436	Merge branch 'feat/alerts_listing_page_revamp' into feat/alert_rule_views	2026-09-17 12:34:36 +05:30
Nikhil Mantri	95c11d0550	Merge branch 'main' into feat/alerts_listing_page_revamp	2026-09-17 12:34:23 +05:30
Nikhil Mantri	b2810ec117	Merge branch 'feat/alerts_listing_page_revamp' into feat/alert_rule_views	2026-09-16 15:48:59 +05:30
Naman Verma	7556dd2868	Merge branch 'main' into feat/alerts_listing_page_revamp	2026-09-16 11:28:20 +05:30
Nikhil Mantri	339a10217e	Merge branch 'feat/alerts_listing_page_revamp' into feat/alert_rule_views	2026-09-10 18:57:09 +05:30
Nikhil Mantri	cd0eb62734	Merge branch 'main' into feat/alerts_listing_page_revamp	2026-09-10 18:56:27 +05:30
nikhilmantri0902	a667007991	Merge remote-tracking branch 'origin/feat/alerts_listing_page_revamp' into feat/alert_rule_views	2026-09-10 16:04:32 +05:30
nikhilmantri0902	208fc1e8ec	Merge remote-tracking branch 'origin/feat/common_out_visitors_and_sql_parser' into feat/alerts_listing_page_revamp	2026-09-10 15:58:38 +05:30
nikhilmantri0902	54eb67392a	refactor(filterquery): order the compiler main flow first Visit methods follow Compile; builders, extractors and operator spelling sit below with main's section separators.	2026-09-10 15:53:07 +05:30
nikhilmantri0902	0e0d97c16f	refactor(filterquery): address review nits on the compiler Verb-first helper names (BuildStringOperation etc., ResolveFreeText), Sb and Formatter as exported fields instead of getters, and tests for the dangling-backslash rejection.	2026-09-10 15:43:58 +05:30
nikhilmantri0902	659f9c7ecf	test(ruletypes): assert UpdatedAt strictly advances on view update	2026-09-10 13:09:54 +05:30
nikhilmantri0902	ce8442c17a	chore(ruler): drop rationale comments from rule view code	2026-09-10 13:09:53 +05:30
nikhilmantri0902	7ab21678b5	test(alerts): own rule view cleanup in a fixture The lifecycle test filters lists by its own view names instead of wiping the org's views and asserting global counts.	2026-09-10 13:02:47 +05:30
nikhilmantri0902	951bfb66cd	fix(ruletypes): never return null states on a rule view Validate normalizes nil states to an empty slice and the field is marked non-nullable; regenerates the openapi spec and the frontend api client.	2026-09-10 13:02:42 +05:30
nikhilmantri0902	113685fbdb	refactor(sqlmigration): create the rule_view index via bun builder Matches the package's index precedent and idx_ naming.	2026-09-10 12:45:05 +05:30
nikhilmantri0902	b9c306dd26	refactor(ruletypes): share list filter validation between params and views ListRulesParams and RuleViewData now embed one ListFilter with a single Validate, mirroring dashboards; filter errors surface as rule_list_invalid.	2026-09-10 12:36:24 +05:30
nikhilmantri0902	7e71d4507c	Merge remote-tracking branch 'origin/feat/common_out_visitors_and_sql_parser' into feat/alerts_listing_page_revamp	2026-09-09 20:10:09 +05:30
nikhilmantri0902	e13cb08097	refactor(filterquery): collapse the builder into the visitor One Visitor struct now carries sb, fmter and errors like the old per-feature visitors did; FieldResolver stays the only new concept.	2026-09-09 20:08:33 +05:30
nikhilmantri0902	1e7aaa9f14	feat(ruler): add saved views CRUD for the alerts list page A saved view stores the v3 list params (query, states, sort, order) in a new rule_view table and replays them; shapes mirror dashboard views.	2026-09-09 15:57:47 +05:30
nikhilmantri0902	09ab9f4081	Merge branch 'feat/common_out_visitors_and_sql_parser' into feat/alerts_listing_page_revamp	2026-09-09 11:41:05 +05:30
nikhilmantri0902	f945b5f513	refactor(dashboard): port the list filter to the shared sqlcompiler The visitor moves to a key-policy resolver plus an error-code wrap; emitted SQL is unchanged, pinned by the existing exact-SQL unit suite.	2026-09-09 11:33:35 +05:30
nikhilmantri0902	8b0ab0ff26	refactor(filterquery): add shared list filter SQL compiler Extracted from the dashboards list visitor: grammar walk, operator dispatch, value extraction, LIKE builders and the Compiled output type, behind a per-feature FieldResolver. Scope is list pages over the relational store; telemetry queries stay on querybuilder. Also rejects LIKE and ILIKE patterns ending in an unescaped backslash, which never match on sqlite and abort the query on Postgres.	2026-09-09 11:33:34 +05:30
Nikhil Mantri	f2679a6866	Merge branch 'main' into feat/alerts_listing_page_revamp	2026-09-08 17:47:29 +05:30
nikhilmantri0902	253a117849	refactor: address list API nits Use fmt.Sprintf over string concatenation in the compiler, rule store and JSON formatters; build the enum value lists once as package vars; collapse the repeated integration seed blocks into a seed_alert_rules fixture and drop name-restating fixture docstrings.	2026-09-08 17:42:46 +05:30
nikhilmantri0902	c9538be38f	style: trim list API comments to one line per the repo comment rules	2026-09-08 17:16:18 +05:30
nikhilmantri0902	be51c37317	fix(sqlcompiler): reject LIKE patterns ending in an unescaped backslash Such a pattern never matches on sqlite and aborts the query on Postgres when the matcher consumes the dangling escape, turning user input into a data-dependent 500. Reject it as a 400 on both list endpoints; a literal trailing backslash stays expressible as an escaped backslash. Also move the Compiled type into sqlcompiler, leaving each feature only the error-code wrap.	2026-09-08 17:16:11 +05:30
nikhilmantri0902	66796d1767	refactor: extract shared filter query SQL compiler from dashboards and rules The dashboards and rules list visitors were near-identical: boolean composition, operator dispatch, value extraction and the LIKE family builders. Move that core to pkg/parser/filterquery/sqlcompiler behind a FieldResolver interface; each feature keeps only its key policy. Scope is the bun-managed relational store, telemetry stays on querybuilder. Verified by both features' unchanged exact-SQL unit suites, the dashboard integration suite and the rules list suite on both providers.	2026-09-08 15:44:38 +05:30
nikhilmantri0902	8e19b17855	test(sqlrulestore): pin deep-nesting compile cases before visitor extraction Four hand-derived cases covering mixed predicate kinds, parenthesized OR groups, NOT over a group and three-level nesting with free text and a timestamp, matching the depth of dashboards' ComplexExamples suite.	2026-09-08 15:06:11 +05:30
nikhilmantri0902	8885497e14	chore: further cleanup	2026-09-08 12:31:33 +05:30
nikhilmantri0902	626e047485	refactor: trim comments to constraint-only per repo comment rules Rationale and restatements move out of source; dialect reasoning for LIKE ESCAPE and ILIKE lowering is documented once in the PR body.	2026-09-08 12:13:16 +05:30
nikhilmantri0902	cc3d86c3ec	fix(rules): take the read lock in TriggeredAlerts The lock has been commented out since the method landed, leaving the rules map read unguarded against concurrent manager writes. Same class of race this branch fixed in ListRuleStates and GetRule.	2026-09-08 11:54:05 +05:30
nikhilmantri0902	0100083284	fix(sqlstore): drop unusable quote escape from sqlite JSON map paths sqlite JSON paths have no backslash escapes, so escaping a double quote in the key produced a path sqlite cannot parse. The character is also unreachable: the filter grammar's KEY token cannot contain a quote. Keep the backslash escape, which matches sqlite's raw key comparison.	2026-09-08 11:44:05 +05:30
Nikhil Mantri	648e945471	Merge branch 'main' into feat/alerts_listing_page_revamp	2026-09-08 11:07:26 +05:30
nikhilmantri0902	7323d5ae0b	fix(ruletypes): make list sort deterministic on ties Ties on the primary sort key kept arbitrary DB order, so rows could shuffle between page requests causing overlaps or misses. Break ties on name (case-insensitive) then id, always ascending, with the requested order applied to the primary key only. Pin the tiebreak in unit tests and paginate over state ties in the integration suite.	2026-09-08 01:16:39 +05:30
nikhilmantri0902	578b9172ba	test(integration): cover the rules list v3 API on both sqlstore providers Seeds five rules spanning every filter axis and pins the envelope, slim rows, DSL filters (incl. dotted label keys and missing-label-as-empty semantics), states param, sort ranks, pagination totals and the error contract; adds delete_all_rules and an idempotent ensure_notification_channel fixture fn. Verified against both sqlite and postgres providers.	2026-09-07 20:20:54 +05:30
nikhilmantri0902	2110006d17	feat(sqlrulestore): treat a missing label as empty string for all label value operators COALESCE applies uniformly instead of only on negations, so labels.key = '' also matches label-less rules; EXISTS/NOT EXISTS remain the presence checks.	2026-09-07 17:39:41 +05:30
nikhilmantri0902	01dda19d17	feat(sqlrulestore): align label filter semantics with the querier severity takes the labels operator set (it is an alias for labels.severity, so EXISTS/NOT EXISTS now work on it), and negative label operators evaluate a missing label as the empty string instead of always matching, mirroring the querier's AddDefaultExistsFilter map-attribute semantics.	2026-09-07 17:27:07 +05:30
nikhilmantri0902	b519574b89	feat(ruler): add GET /api/v3/rules route and regenerate API clients Registers ListRulesV3 with the list params and envelope, marks the v2 ListRules operation deprecated, and regenerates the OpenAPI spec and the frontend client.	2026-09-07 14:54:46 +05:30
nikhilmantri0902	629ecabce7	feat(ruler): list rules with SQL filter pushdown, state overlay and in-memory pagination DSL query compiles into the store's WHERE; state is overlaid from a snapshot of the rule manager map taken under RLock, then the states filter, total, sort (state/severity rank comparators) and offset/limit run in code so total always matches what is pageable. StorableRule gains alias:rule to match the compiler's column references. Also guards the previously unlocked m.rules reads in ListRuleStates and GetRule.	2026-09-07 14:43:40 +05:30
nikhilmantri0902	131e302c55	feat(sqlrulestore): compile rule list filter DSL to SQL Adds JSONExtractMapValue to SQLFormatter so a labels map key is one path segment (dotted label keys work on both dialects), and a visitor over the shared filterquery grammar mapping rule list DSL keys to SQL.	2026-09-07 13:58:30 +05:30
nikhilmantri0902	239c92ba67	feat(ruletypes): add list params, filter allow-lists and listable rule types for rules list API	2026-09-07 12:48:49 +05:30