fix: update integration test

feat(authz): enable FGA for llm pricing rule routes
2026-10-28 20:10:43 +00:00 · 2026-10-26 16:52:56 +05:30 · 2026-10-26 15:57:28 +05:30
36 changed files with 935 additions and 4272 deletions
--- a/docs/api/openapi.yml
+++ b/docs/api/openapi.yml
@@ -3659,6 +3659,7 @@ components:
      - logs-field
      - traces-field
      - metrics-field
+      - llm-pricing-rule
      type: string
    CoretypesObject:
      properties:
@@ -13196,9 +13197,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - planned-maintenance:list
+        - VIEWER
      - tokenizer:
-        - planned-maintenance:list
+        - VIEWER
      summary: List downtime schedules
      tags:
      - downtimeschedules
@@ -13253,13 +13254,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - planned-maintenance:create
-        - planned-maintenance:attach
-        - rule:attach
+        - EDITOR
      - tokenizer:
-        - planned-maintenance:create
-        - planned-maintenance:attach
-        - rule:attach
+        - EDITOR
      summary: Create downtime schedule
      tags:
      - downtimeschedules
@@ -13304,9 +13301,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - planned-maintenance:delete
+        - EDITOR
      - tokenizer:
-        - planned-maintenance:delete
+        - EDITOR
      summary: Delete downtime schedule
      tags:
      - downtimeschedules
@@ -13362,9 +13359,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - planned-maintenance:read
+        - VIEWER
      - tokenizer:
-        - planned-maintenance:read
+        - VIEWER
      summary: Get downtime schedule by ID
      tags:
      - downtimeschedules
@@ -13419,17 +13416,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - planned-maintenance:update
-        - planned-maintenance:attach
-        - planned-maintenance:detach
-        - rule:attach
-        - rule:detach
+        - EDITOR
      - tokenizer:
-        - planned-maintenance:update
-        - planned-maintenance:attach
-        - planned-maintenance:detach
-        - rule:attach
-        - rule:detach
+        - EDITOR
      summary: Update downtime schedule
      tags:
      - downtimeschedules
@@ -13775,9 +13764,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - llm-pricing-rule:list
      - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:list
      summary: List pricing rules
      tags:
      - llmpricingrules
@@ -13822,9 +13811,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - ADMIN
+        - llm-pricing-rule:update
      - tokenizer:
-        - ADMIN
+        - llm-pricing-rule:update
      summary: Create or update pricing rules
      tags:
      - llmpricingrules
@@ -13870,9 +13859,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - ADMIN
+        - llm-pricing-rule:delete
      - tokenizer:
-        - ADMIN
+        - llm-pricing-rule:delete
      summary: Delete a pricing rule
      tags:
      - llmpricingrules
@@ -13928,9 +13917,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - llm-pricing-rule:read
      - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:read
      summary: Get a pricing rule
      tags:
      - llmpricingrules
@@ -13983,9 +13972,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - llm-pricing-rule:list
      - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:list
      summary: List unmapped models
      tags:
      - llmpricingrules
@@ -14712,9 +14701,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - route-policy:list
+        - VIEWER
      - tokenizer:
-        - route-policy:list
+        - VIEWER
      summary: List route policies
      tags:
      - routepolicies
@@ -14769,13 +14758,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - route-policy:create
-        - route-policy:attach
-        - notification-channel:attach
+        - ADMIN
      - tokenizer:
-        - route-policy:create
-        - route-policy:attach
-        - notification-channel:attach
+        - ADMIN
      summary: Create route policy
      tags:
      - routepolicies
@@ -14820,9 +14805,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - route-policy:delete
+        - ADMIN
      - tokenizer:
-        - route-policy:delete
+        - ADMIN
      summary: Delete route policy
      tags:
      - routepolicies
@@ -14878,9 +14863,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - route-policy:read
+        - VIEWER
      - tokenizer:
-        - route-policy:read
+        - VIEWER
      summary: Get route policy by ID
      tags:
      - routepolicies
@@ -14947,17 +14932,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - route-policy:update
-        - route-policy:attach
-        - route-policy:detach
-        - notification-channel:attach
-        - notification-channel:detach
+        - ADMIN
      - tokenizer:
-        - route-policy:update
-        - route-policy:attach
-        - route-policy:detach
-        - notification-channel:attach
-        - notification-channel:detach
+        - ADMIN
      summary: Update route policy
      tags:
      - routepolicies
@@ -22355,9 +22332,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:list
+        - VIEWER
      - tokenizer:
-        - rule:list
+        - VIEWER
      summary: List rule saved views
      tags:
      - rules
@@ -22413,9 +22390,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:list
+        - VIEWER
      - tokenizer:
-        - rule:list
+        - VIEWER
      summary: Create rule saved view
      tags:
      - rules
@@ -22467,9 +22444,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:list
+        - VIEWER
      - tokenizer:
-        - rule:list
+        - VIEWER
      summary: Delete rule saved view
      tags:
      - rules
@@ -22536,9 +22513,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:list
+        - VIEWER
      - tokenizer:
-        - rule:list
+        - VIEWER
      summary: Update rule saved view
      tags:
      - rules
@@ -22587,9 +22564,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:list
+        - VIEWER
      - tokenizer:
-        - rule:list
+        - VIEWER
      summary: List alert rules
      tags:
      - rules
@@ -23428,23 +23405,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
      - tokenizer:
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
      summary: Create alert rule
      tags:
      - rules
@@ -23489,9 +23452,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:delete
+        - EDITOR
      - tokenizer:
-        - rule:delete
+        - EDITOR
      summary: Delete alert rule
      tags:
      - rules
@@ -23547,9 +23510,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:read
+        - VIEWER
      - tokenizer:
-        - rule:read
+        - VIEWER
      summary: Get alert rule by ID
      tags:
      - rules
@@ -24400,27 +24363,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:update
-        - rule:attach
-        - rule:detach
-        - notification-channel:attach
-        - notification-channel:detach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
      - tokenizer:
-        - rule:update
-        - rule:attach
-        - rule:detach
-        - notification-channel:attach
-        - notification-channel:detach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
      summary: Patch alert rule
      tags:
      - rules
@@ -25259,27 +25204,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:update
-        - rule:attach
-        - rule:detach
-        - notification-channel:attach
-        - notification-channel:detach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
      - tokenizer:
-        - rule:update
-        - rule:attach
-        - rule:detach
-        - notification-channel:attach
-        - notification-channel:detach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
      summary: Update alert rule
      tags:
      - rules
@@ -25346,25 +25273,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:read
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
      - tokenizer:
-        - rule:read
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
      summary: Clone alert rule
      tags:
      - rules
@@ -25464,15 +25375,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:read
-        - logs-field:list
-        - traces-field:list
-        - metrics-field:list
+        - VIEWER
      - tokenizer:
-        - rule:read
-        - logs-field:list
-        - traces-field:list
-        - metrics-field:list
+        - VIEWER
      summary: Get rule history filter keys
      tags:
      - rules
@@ -25580,15 +25485,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:read
-        - logs-field:read
-        - traces-field:read
-        - metrics-field:read
+        - VIEWER
      - tokenizer:
-        - rule:read
-        - logs-field:read
-        - traces-field:read
-        - metrics-field:read
+        - VIEWER
      summary: Get rule history filter values
      tags:
      - rules
@@ -25661,9 +25560,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:read
+        - VIEWER
      - tokenizer:
-        - rule:read
+        - VIEWER
      summary: Get rule overall status timeline
      tags:
      - rules
@@ -25733,9 +25632,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:read
+        - VIEWER
      - tokenizer:
-        - rule:read
+        - VIEWER
      summary: Get rule history stats
      tags:
      - rules
@@ -25825,19 +25724,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:read
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - VIEWER
      - tokenizer:
-        - rule:read
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - VIEWER
      summary: Get rule history timeline
      tags:
      - rules
@@ -25910,19 +25799,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:read
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - VIEWER
      - tokenizer:
-        - rule:read
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - VIEWER
      summary: Get top contributors to rule firing
      tags:
      - rules
@@ -26762,23 +26641,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
      - tokenizer:
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
      summary: Test alert rule
      tags:
      - rules
@@ -28644,9 +28509,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - rule:list
+        - VIEWER
      - tokenizer:
-        - rule:list
+        - VIEWER
      summary: List alert rules (v3)
      tags:
      - rules
--- a/frontend/src/api/generated/services/sigNoz.schemas.ts
+++ b/frontend/src/api/generated/services/sigNoz.schemas.ts
@@ -3292,6 +3292,7 @@ export enum CoretypesKindDTO {
 	'logs-field' = 'logs-field',
 	'traces-field' = 'traces-field',
 	'metrics-field' = 'metrics-field',
+	'llm-pricing-rule' = 'llm-pricing-rule',
 }
 export enum CoretypesTypeDTO {
 	user = 'user',
--- a/frontend/src/lib/authz/hooks/useAuthZ/permissions.type.ts
+++ b/frontend/src/lib/authz/hooks/useAuthZ/permissions.type.ts
@@ -21,15 +21,7 @@ export default {
 			{
 				kind: 'notification-channel',
 				type: 'metaresource',
-				allowedVerbs: [
-					'attach',
-					'create',
-					'delete',
-					'detach',
-					'list',
-					'read',
-					'update',
-				],
+				allowedVerbs: ['create', 'delete', 'list', 'read', 'update'],
 			},
 			{
 				kind: 'quick-filter',
--- a/frontend/src/schemas/generated/transactionGroups.schema.json
+++ b/frontend/src/schemas/generated/transactionGroups.schema.json
@@ -74,7 +74,8 @@
        "meter-metrics",
        "logs-field",
        "traces-field",
-        "metrics-field"
+        "metrics-field",
+        "llm-pricing-rule"
      ],
      "type": "string"
    },
--- a/pkg/alertmanager/alertmanager.go
+++ b/pkg/alertmanager/alertmanager.go
@@ -34,9 +34,6 @@ type Alertmanager interface {
 	// ListChannels lists all channels for the organization.
 	ListChannels(context.Context, string) ([]*alertmanagertypes.Channel, error)

-	// GetChannelIDsByNames resolves display names to channel ids and rejects unknown names.
-	GetChannelIDsByNames(context.Context, string, []string) ([]string, error)
-
 	// ListAllChannels lists all channels for all organizations. It is used by the legacy alertmanager only.
 	ListAllChannels(context.Context) ([]*alertmanagertypes.Channel, error)

--- a/pkg/alertmanager/alertmanagertest/alertmanager.go
+++ b/pkg/alertmanager/alertmanagertest/alertmanager.go
@@ -1023,80 +1023,6 @@ func (_c *MockAlertmanager_GetChannelByID_Call) RunAndReturn(run func(context1 c
 	return _c
 }

-// GetChannelIDsByNames provides a mock function for the type MockAlertmanager
-func (_mock *MockAlertmanager) GetChannelIDsByNames(context1 context.Context, s string, strings []string) ([]string, error) {
-	ret := _mock.Called(context1, s, strings)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetChannelIDsByNames")
-	}
-
-	var r0 []string
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, []string) ([]string, error)); ok {
-		return returnFunc(context1, s, strings)
-	}
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, []string) []string); ok {
-		r0 = returnFunc(context1, s, strings)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).([]string)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(context.Context, string, []string) error); ok {
-		r1 = returnFunc(context1, s, strings)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// MockAlertmanager_GetChannelIDsByNames_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetChannelIDsByNames'
-type MockAlertmanager_GetChannelIDsByNames_Call struct {
-	*mock.Call
-}
-
-// GetChannelIDsByNames is a helper method to define mock.On call
-//   - context1 context.Context
-//   - s string
-//   - strings []string
-func (_e *MockAlertmanager_Expecter) GetChannelIDsByNames(context1 any, s any, strings any) *MockAlertmanager_GetChannelIDsByNames_Call {
-	return &MockAlertmanager_GetChannelIDsByNames_Call{Call: _e.mock.On("GetChannelIDsByNames", context1, s, strings)}
-}
-
-func (_c *MockAlertmanager_GetChannelIDsByNames_Call) Run(run func(context1 context.Context, s string, strings []string)) *MockAlertmanager_GetChannelIDsByNames_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 context.Context
-		if args[0] != nil {
-			arg0 = args[0].(context.Context)
-		}
-		var arg1 string
-		if args[1] != nil {
-			arg1 = args[1].(string)
-		}
-		var arg2 []string
-		if args[2] != nil {
-			arg2 = args[2].([]string)
-		}
-		run(
-			arg0,
-			arg1,
-			arg2,
-		)
-	})
-	return _c
-}
-
-func (_c *MockAlertmanager_GetChannelIDsByNames_Call) Return(strings1 []string, err error) *MockAlertmanager_GetChannelIDsByNames_Call {
-	_c.Call.Return(strings1, err)
-	return _c
-}
-
-func (_c *MockAlertmanager_GetChannelIDsByNames_Call) RunAndReturn(run func(context1 context.Context, s string, strings []string) ([]string, error)) *MockAlertmanager_GetChannelIDsByNames_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
 // GetConfig provides a mock function for the type MockAlertmanager
 func (_mock *MockAlertmanager) GetConfig(context1 context.Context, s string) (*alertmanagertypes.Config, error) {
 	ret := _mock.Called(context1, s)
--- a/pkg/alertmanager/signozalertmanager/provider.go
+++ b/pkg/alertmanager/signozalertmanager/provider.go
@@ -147,19 +147,6 @@ func (provider *provider) ListChannels(ctx context.Context, orgID string) ([]*al
 	return channels, err
 }

-func (provider *provider) GetChannelIDsByNames(ctx context.Context, orgID string, names []string) ([]string, error) {
-	if len(names) == 0 {
-		return nil, nil
-	}
-
-	channels, _, err := provider.configStore.ListChannels(ctx, orgID, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	return alertmanagertypes.MapChannelNamesToIDs(channels, names)
-}
-
 func (provider *provider) ListNotificationChannels(ctx context.Context, orgID string, params *alertmanagertypes.ListChannelsParams) (*alertmanagertypes.ListableNotificationChannel, error) {
 	channels, total, err := provider.configStore.ListChannels(ctx, orgID, params)
 	if err != nil {
@@ -541,10 +528,6 @@ func (provider *provider) CreateRoutePolicy(ctx context.Context, routeRequest *a
 		return nil, err
 	}

-	if _, err := provider.GetChannelIDsByNames(ctx, orgID.String(), routeRequest.Channels); err != nil {
-		return nil, err
-	}
-
 	route := alertmanagertypes.RoutePolicy{
 		Expression:     routeRequest.Expression,
 		ExpressionKind: routeRequest.ExpressionKind,
@@ -737,10 +720,6 @@ func (provider *provider) UpdateRoutePolicyByID(ctx context.Context, routeID str
 		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid route: %v", err)
 	}

-	if _, err := provider.GetChannelIDsByNames(ctx, orgID.String(), route.Channels); err != nil {
-		return nil, err
-	}
-
 	existingRoute, err := provider.notificationManager.GetRoutePolicyByID(ctx, claims.OrgID, routeID)
 	if err != nil {
 		return nil, errors.NewInvalidInputf(errors.CodeNotFound, "route not found: %v", err)
--- a/pkg/apiserver/signozapiserver/alertmanager.go
+++ b/pkg/apiserver/signozapiserver/alertmanager.go
@@ -4,7 +4,6 @@ import (
 	"net/http"

 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/ruler"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
@@ -328,167 +327,88 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 		return err
 	}

-	if err := router.Handle("/api/v1/route_policies", handler.New(
-		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.GetAllRoutePolicies, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "GetAllRoutePolicies",
-			Tags:                []string{"routepolicies"},
-			Summary:             "List route policies",
-			Description:         "This endpoint lists all route policies for the organization",
-			Response:            make([]*alertmanagertypes.GettableRoutePolicy, 0),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRoutePolicy,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies", handler.New(provider.authzMiddleware.ViewAccess(provider.alertmanagerHandler.GetAllRoutePolicies), handler.OpenAPIDef{
+		ID:                  "GetAllRoutePolicies",
+		Tags:                []string{"routepolicies"},
+		Summary:             "List route policies",
+		Description:         "This endpoint lists all route policies for the organization",
+		Request:             nil,
+		RequestContentType:  "",
+		Response:            make([]*alertmanagertypes.GettableRoutePolicy, 0),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{},
+		Deprecated:          false,
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.GetRoutePolicyByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "GetRoutePolicyByID",
-			Tags:                []string{"routepolicies"},
-			Summary:             "Get route policy by ID",
-			Description:         "This endpoint returns a route policy by ID",
-			Response:            new(alertmanagertypes.GettableRoutePolicy),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusNotFound},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRoutePolicy,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.alertmanagerHandler.GetRoutePolicyByID), handler.OpenAPIDef{
+		ID:                  "GetRoutePolicyByID",
+		Tags:                []string{"routepolicies"},
+		Summary:             "Get route policy by ID",
+		Description:         "This endpoint returns a route policy by ID",
+		Request:             nil,
+		RequestContentType:  "",
+		Response:            new(alertmanagertypes.GettableRoutePolicy),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusNotFound},
+		Deprecated:          false,
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/route_policies", handler.New(
-		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.CreateRoutePolicy, authtypes.SigNozAdminRoleName),
-		handler.OpenAPIDef{
-			ID:                  "CreateRoutePolicy",
-			Tags:                []string{"routepolicies"},
-			Summary:             "Create route policy",
-			Description:         "This endpoint creates a route policy",
-			Request:             new(alertmanagertypes.PostableRoutePolicy),
-			RequestContentType:  "application/json",
-			Response:            new(alertmanagertypes.GettableRoutePolicy),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusCreated,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes: newScopedSecuritySchemes([]string{
-				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbCreate),
-				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-			}),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRoutePolicy,
-				Verb:     coretypes.VerbCreate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.ResponseJSONPath("data.id"),
-				Selector: coretypes.WildcardSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
-				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
-				SourceSelector: coretypes.WildcardSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewCreateRoutePolicyChannelAttachExtractor(provider.alertmanagerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-		),
-	)).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.CreateRoutePolicy), handler.OpenAPIDef{
+		ID:                  "CreateRoutePolicy",
+		Tags:                []string{"routepolicies"},
+		Summary:             "Create route policy",
+		Description:         "This endpoint creates a route policy",
+		Request:             new(alertmanagertypes.PostableRoutePolicy),
+		RequestContentType:  "application/json",
+		Response:            new(alertmanagertypes.GettableRoutePolicy),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusCreated,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		Deprecated:          false,
+		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.UpdateRoutePolicy, authtypes.SigNozAdminRoleName),
-		handler.OpenAPIDef{
-			ID:                  "UpdateRoutePolicy",
-			Tags:                []string{"routepolicies"},
-			Summary:             "Update route policy",
-			Description:         "This endpoint updates a route policy by ID",
-			Request:             new(alertmanagertypes.PostableRoutePolicy),
-			RequestContentType:  "application/json",
-			Response:            new(alertmanagertypes.GettableRoutePolicy),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes: newScopedSecuritySchemes([]string{
-				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbUpdate),
-				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbDetach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
-			}),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRoutePolicy,
-				Verb:     coretypes.VerbUpdate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.PathParam("id"),
-				Selector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewUpdateRoutePolicyChannelAttachExtractor(provider.alertmanagerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbDetach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewUpdateRoutePolicyChannelDetachExtractor(provider.alertmanagerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-		),
-	)).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.UpdateRoutePolicy), handler.OpenAPIDef{
+		ID:                  "UpdateRoutePolicy",
+		Tags:                []string{"routepolicies"},
+		Summary:             "Update route policy",
+		Description:         "This endpoint updates a route policy by ID",
+		Request:             new(alertmanagertypes.PostableRoutePolicy),
+		RequestContentType:  "application/json",
+		Response:            new(alertmanagertypes.GettableRoutePolicy),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		Deprecated:          false,
+		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.DeleteRoutePolicyByID, authtypes.SigNozAdminRoleName),
-		handler.OpenAPIDef{
-			ID:                "DeleteRoutePolicyByID",
-			Tags:              []string{"routepolicies"},
-			Summary:           "Delete route policy",
-			Description:       "This endpoint deletes a route policy by ID",
-			SuccessStatusCode: http.StatusNoContent,
-			ErrorStatusCodes:  []int{http.StatusNotFound},
-			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbDelete)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRoutePolicy,
-			Verb:     coretypes.VerbDelete,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.DeleteRoutePolicyByID), handler.OpenAPIDef{
+		ID:                  "DeleteRoutePolicyByID",
+		Tags:                []string{"routepolicies"},
+		Summary:             "Delete route policy",
+		Description:         "This endpoint deletes a route policy by ID",
+		Request:             nil,
+		RequestContentType:  "",
+		Response:            nil,
+		ResponseContentType: "",
+		SuccessStatusCode:   http.StatusNoContent,
+		ErrorStatusCodes:    []int{http.StatusNotFound},
+		Deprecated:          false,
+		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+	})).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

--- a/pkg/apiserver/signozapiserver/llmpricingrule.go
+++ b/pkg/apiserver/signozapiserver/llmpricingrule.go
@@ -4,14 +4,15 @@ import (
 	"net/http"

 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/llmpricingruletypes"
 	"github.com/gorilla/mux"
 )

 func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 	if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.List),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.List, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListLLMPricingRules",
 			Tags:                []string{"llmpricingrules"},
@@ -25,14 +26,20 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.CreateOrUpdate),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.CreateOrUpdate, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                 "CreateOrUpdateLLMPricingRules",
 			Tags:               []string{"llmpricingrules"},
@@ -43,14 +50,20 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:  http.StatusNoContent,
 			ErrorStatusCodes:   []int{http.StatusBadRequest},
 			Deprecated:         false,
-			SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbUpdate)}),
 		},
+		handler.WithResourceDefs(handler.TelemetryResourceDef{
+			Verb:      coretypes.VerbUpdate,
+			Category:  coretypes.ActionCategoryConfigurationChange,
+			Selector:  llmpricingruletypes.RuleSelector,
+			Resources: llmpricingruletypes.UpdatableRulesResources,
+		}),
 	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v1/llm_pricing_rules/unmapped_models", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.ListUnmappedModels),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.ListUnmappedModels, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListUnmappedLLMModels",
 			Tags:                []string{"llmpricingrules"},
@@ -63,14 +76,20 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.Get),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Get, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetLLMPricingRule",
 			Tags:                []string{"llmpricingrules"},
@@ -83,14 +102,21 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.Delete),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Delete, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "DeleteLLMPricingRule",
 			Tags:                []string{"llmpricingrules"},
@@ -103,8 +129,15 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbDelete)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
--- a/pkg/apiserver/signozapiserver/provider.go
+++ b/pkg/apiserver/signozapiserver/provider.go
@@ -91,11 +91,9 @@ type provider struct {
 	ruleStateHistoryHandler    rulestatehistory.Handler
 	spanMapperHandler          spanmapper.Handler
 	alertmanagerHandler        alertmanager.Handler
-	alertmanagerService        alertmanager.Alertmanager
 	prometheusHandler          prometheus.Handler
 	traceDetailHandler         tracedetail.Handler
 	rulerHandler               ruler.Handler
-	rulerService               ruler.Ruler
 	llmPricingRuleHandler      llmpricingrule.Handler
 	statsHandler               statsreporter.Handler
 	savedViewHandler           savedview.Handler
@@ -138,12 +136,10 @@ func NewFactory(
 	ruleStateHistoryHandler rulestatehistory.Handler,
 	spanMapperHandler spanmapper.Handler,
 	alertmanagerHandler alertmanager.Handler,
-	alertmanagerService alertmanager.Alertmanager,
 	prometheusHandler prometheus.Handler,
 	llmPricingRuleHandler llmpricingrule.Handler,
 	traceDetailHandler tracedetail.Handler,
 	rulerHandler ruler.Handler,
-	rulerService ruler.Ruler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
 	globalConfig global.Config,
@@ -193,12 +189,10 @@ func NewFactory(
 			ruleStateHistoryHandler,
 			spanMapperHandler,
 			alertmanagerHandler,
-			alertmanagerService,
 			prometheusHandler,
 			llmPricingRuleHandler,
 			traceDetailHandler,
 			rulerHandler,
-			rulerService,
 			statsHandler,
 			savedViewHandler,
 			globalConfig,
@@ -250,12 +244,10 @@ func newProvider(
 	ruleStateHistoryHandler rulestatehistory.Handler,
 	spanMapperHandler spanmapper.Handler,
 	alertmanagerHandler alertmanager.Handler,
-	alertmanagerService alertmanager.Alertmanager,
 	prometheusHandler prometheus.Handler,
 	llmPricingRuleHandler llmpricingrule.Handler,
 	traceDetailHandler tracedetail.Handler,
 	rulerHandler ruler.Handler,
-	rulerService ruler.Ruler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
 	globalConfig global.Config,
@@ -307,11 +299,9 @@ func newProvider(
 		ruleStateHistoryHandler:    ruleStateHistoryHandler,
 		spanMapperHandler:          spanMapperHandler,
 		alertmanagerHandler:        alertmanagerHandler,
-		alertmanagerService:        alertmanagerService,
 		prometheusHandler:          prometheusHandler,
 		traceDetailHandler:         traceDetailHandler,
 		rulerHandler:               rulerHandler,
-		rulerService:               rulerService,
 		llmPricingRuleHandler:      llmPricingRuleHandler,
 		statsHandler:               statsHandler,
 		savedViewHandler:           savedViewHandler,
--- a/pkg/apiserver/signozapiserver/ruler.go
+++ b/pkg/apiserver/signozapiserver/ruler.go
@@ -4,633 +4,273 @@ import (
 	"net/http"

 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	"github.com/SigNoz/signoz/pkg/ruler"
+	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/ruletypes"
 	"github.com/gorilla/mux"
 )

 func (provider *provider) addRulerRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/rules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "ListRules",
-			Tags:                []string{"rules"},
-			Summary:             "List alert rules",
-			Description:         "This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.",
-			Response:            make([]*ruletypes.Rule, 0),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			Deprecated:          true,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRules), handler.OpenAPIDef{
+		ID:                  "ListRules",
+		Tags:                []string{"rules"},
+		Summary:             "List alert rules",
+		Description:         "This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.",
+		Response:            make([]*ruletypes.Rule, 0),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		Deprecated:          true,
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v3/rules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRulesV3, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "ListRulesV3",
-			Tags:                []string{"rules"},
-			Summary:             "List alert rules (v3)",
-			Description:         "Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). In the filter DSL, a non-reserved key is matched as a rule label directly (`team = infra`); a key that collides with a reserved keyword matches either interpretation (negative operators exclude both), and `labels.<key>` targets only the label. The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.",
-			RequestQuery:        new(ruletypes.ListRulesParams),
-			Response:            new(ruletypes.ListableRules),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v3/rules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRulesV3), handler.OpenAPIDef{
+		ID:                  "ListRulesV3",
+		Tags:                []string{"rules"},
+		Summary:             "List alert rules (v3)",
+		Description:         "Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). In the filter DSL, a non-reserved key is matched as a rule label directly (`team = infra`); a key that collides with a reserved keyword matches either interpretation (negative operators exclude both), and `labels.<key>` targets only the label. The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.",
+		RequestQuery:        new(ruletypes.ListRulesParams),
+		Response:            new(ruletypes.ListableRules),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.GetRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "GetRuleByID",
-			Tags:                []string{"rules"},
-			Summary:             "Get alert rule by ID",
-			Description:         "This endpoint returns an alert rule by ID",
-			Response:            new(ruletypes.Rule),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusNotFound},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.GetRuleByID), handler.OpenAPIDef{
+		ID:                  "GetRuleByID",
+		Tags:                []string{"rules"},
+		Summary:             "Get alert rule by ID",
+		Description:         "This endpoint returns an alert rule by ID",
+		Response:            new(ruletypes.Rule),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                  "CreateRule",
-			Tags:                []string{"rules"},
-			Summary:             "Create alert rule",
-			Description:         "This endpoint creates a new alert rule",
-			Request:             new(ruletypes.PostableRule),
-			RequestContentType:  "application/json",
-			RequestExamples:     postableRuleExamples(),
-			Response:            new(ruletypes.Rule),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusCreated,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes: newScopedSecuritySchemes(append([]string{
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-			}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbCreate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.ResponseJSONPath("data.id"),
-				Selector: coretypes.WildcardSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
-				SourceSelector: coretypes.WildcardSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewCreateRuleChannelAttachExtractor(provider.alertmanagerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  querybuilder.TelemetrySelector,
-				Resources: ruler.NewRuleBodyTelemetryResources(),
-			},
-		),
-	)).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CreateRule), handler.OpenAPIDef{
+		ID:                  "CreateRule",
+		Tags:                []string{"rules"},
+		Summary:             "Create alert rule",
+		Description:         "This endpoint creates a new alert rule",
+		Request:             new(ruletypes.PostableRule),
+		RequestContentType:  "application/json",
+		RequestExamples:     postableRuleExamples(),
+		Response:            new(ruletypes.Rule),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusCreated,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules/{id}/clone", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.CloneRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                  "CloneRuleByID",
-			Tags:                []string{"rules"},
-			Summary:             "Clone alert rule",
-			Description:         "This endpoint creates a new alert rule from the stored definition of an existing one. The clone keeps every modeled field of the source, including its enabled/disabled state, and gets the source's name suffixed with \" - Copy\" (or a bumped \" - Copy (n)\" counter when the source is itself a copy). The clone is owned by the caller.",
-			Response:            new(ruletypes.Rule),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusCreated,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes: newScopedSecuritySchemes(append([]string{
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-			}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbRead,
-				Category: coretypes.ActionCategoryDataAccess,
-				ID:       coretypes.PathParam("id"),
-				Selector: coretypes.IDSelector,
-			},
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbCreate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.ResponseJSONPath("data.id"),
-				Selector: coretypes.WildcardSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
-				SourceSelector: coretypes.WildcardSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewCloneRuleChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  querybuilder.TelemetrySelector,
-				Resources: ruler.NewRuleQueryTelemetryResources(provider.rulerService),
-			},
-		),
-	)).Methods(http.MethodPost).GetError(); err != nil {
-		return err
-	}
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                 "UpdateRuleByID",
-			Tags:               []string{"rules"},
-			Summary:            "Update alert rule",
-			Description:        "This endpoint updates an alert rule by ID",
-			Request:            new(ruletypes.PostableRule),
-			RequestContentType: "application/json",
-			RequestExamples:    postableRuleExamples(),
-			SuccessStatusCode:  http.StatusNoContent,
-			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes: newScopedSecuritySchemes(append([]string{
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
-			}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbUpdate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.PathParam("id"),
-				Selector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewReplaceRuleChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbDetach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewReplaceRuleChannelDetachExtractor(provider.alertmanagerService, provider.rulerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  querybuilder.TelemetrySelector,
-				Resources: ruler.NewRuleBodyTelemetryResources(),
-			},
-		),
-	)).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}/clone", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CloneRuleByID), handler.OpenAPIDef{
+		ID:                  "CloneRuleByID",
+		Tags:                []string{"rules"},
+		Summary:             "Clone alert rule",
+		Description:         "This endpoint creates a new alert rule from the stored definition of an existing one. The clone keeps every modeled field of the source, including its enabled/disabled state, and gets the source's name suffixed with \" - Copy\" (or a bumped \" - Copy (n)\" counter when the source is itself a copy). The clone is owned by the caller.",
+		Response:            new(ruletypes.Rule),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusCreated,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                "DeleteRuleByID",
-			Tags:              []string{"rules"},
-			Summary:           "Delete alert rule",
-			Description:       "This endpoint deletes an alert rule by ID",
-			SuccessStatusCode: http.StatusNoContent,
-			ErrorStatusCodes:  []int{http.StatusNotFound},
-			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDelete)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbDelete,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.UpdateRuleByID), handler.OpenAPIDef{
+		ID:                 "UpdateRuleByID",
+		Tags:               []string{"rules"},
+		Summary:            "Update alert rule",
+		Description:        "This endpoint updates an alert rule by ID",
+		Request:            new(ruletypes.PostableRule),
+		RequestContentType: "application/json",
+		RequestExamples:    postableRuleExamples(),
+		SuccessStatusCode:  http.StatusNoContent,
+		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.PatchRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                  "PatchRuleByID",
-			Tags:                []string{"rules"},
-			Summary:             "Patch alert rule",
-			Description:         "This endpoint applies a partial update to an alert rule by ID",
-			Request:             new(ruletypes.PostableRule),
-			RequestContentType:  "application/json",
-			RequestExamples:     postableRuleExamples(),
-			Response:            new(ruletypes.Rule),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes: newScopedSecuritySchemes(append([]string{
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
-			}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbUpdate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.PathParam("id"),
-				Selector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewPatchRuleChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbDetach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewPatchRuleChannelDetachExtractor(provider.alertmanagerService, provider.rulerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  querybuilder.TelemetrySelector,
-				Resources: ruler.NewOptionalRuleBodyTelemetryResources(),
-				Optional:  true,
-			},
-		),
-	)).Methods(http.MethodPatch).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.DeleteRuleByID), handler.OpenAPIDef{
+		ID:                "DeleteRuleByID",
+		Tags:              []string{"rules"},
+		Summary:           "Delete alert rule",
+		Description:       "This endpoint deletes an alert rule by ID",
+		SuccessStatusCode: http.StatusNoContent,
+		ErrorStatusCodes:  []int{http.StatusNotFound},
+		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rules/test", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.TestRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                  "TestRule",
-			Tags:                []string{"rules"},
-			Summary:             "Test alert rule",
-			Description:         "This endpoint fires a test notification for the given rule definition",
-			Request:             new(ruletypes.PostableRule),
-			RequestContentType:  "application/json",
-			RequestExamples:     postableRuleExamples(),
-			Response:            new(ruletypes.GettableTestRule),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes: newScopedSecuritySchemes(append([]string{
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-			}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbCreate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				Selector: coretypes.WildcardSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceSelector: coretypes.WildcardSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewCreateRuleChannelAttachExtractor(provider.alertmanagerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  querybuilder.TelemetrySelector,
-				Resources: ruler.NewRuleBodyTelemetryResources(),
-			},
-		),
-	)).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.PatchRuleByID), handler.OpenAPIDef{
+		ID:                  "PatchRuleByID",
+		Tags:                []string{"rules"},
+		Summary:             "Patch alert rule",
+		Description:         "This endpoint applies a partial update to an alert rule by ID",
+		Request:             new(ruletypes.PostableRule),
+		RequestContentType:  "application/json",
+		RequestExamples:     postableRuleExamples(),
+		Response:            new(ruletypes.Rule),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rule_views", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRuleViews, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "ListRuleViews",
-			Tags:                []string{"rules"},
-			Summary:             "List rule saved views",
-			Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
-			Response:            new(ruletypes.ListableRuleViews),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/test", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.TestRule), handler.OpenAPIDef{
+		ID:                  "TestRule",
+		Tags:                []string{"rules"},
+		Summary:             "Test alert rule",
+		Description:         "This endpoint fires a test notification for the given rule definition",
+		Request:             new(ruletypes.PostableRule),
+		RequestContentType:  "application/json",
+		RequestExamples:     postableRuleExamples(),
+		Response:            new(ruletypes.GettableTestRule),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rule_views", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "CreateRuleView",
-			Tags:                []string{"rules"},
-			Summary:             "Create rule saved view",
-			Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
-			Request:             new(ruletypes.PostableRuleView),
-			RequestContentType:  "application/json",
-			Response:            new(ruletypes.RuleView),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusCreated,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRuleViews), handler.OpenAPIDef{
+		ID:                  "ListRuleViews",
+		Tags:                []string{"rules"},
+		Summary:             "List rule saved views",
+		Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
+		Response:            new(ruletypes.ListableRuleViews),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "UpdateRuleView",
-			Tags:                []string{"rules"},
-			Summary:             "Update rule saved view",
-			Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
-			Request:             new(ruletypes.UpdatableRuleView),
-			RequestContentType:  "application/json",
-			Response:            new(ruletypes.RuleView),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.CreateRuleView), handler.OpenAPIDef{
+		ID:                  "CreateRuleView",
+		Tags:                []string{"rules"},
+		Summary:             "Create rule saved view",
+		Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
+		Request:             new(ruletypes.PostableRuleView),
+		RequestContentType:  "application/json",
+		Response:            new(ruletypes.RuleView),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusCreated,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "DeleteRuleView",
-			Tags:                []string{"rules"},
-			Summary:             "Delete rule saved view",
-			Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusNoContent,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.UpdateRuleView), handler.OpenAPIDef{
+		ID:                  "UpdateRuleView",
+		Tags:                []string{"rules"},
+		Summary:             "Update rule saved view",
+		Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
+		Request:             new(ruletypes.UpdatableRuleView),
+		RequestContentType:  "application/json",
+		Response:            new(ruletypes.RuleView),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/downtime_schedules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListDowntimeSchedules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "ListDowntimeSchedules",
-			Tags:                []string{"downtimeschedules"},
-			Summary:             "List downtime schedules",
-			Description:         "This endpoint lists all planned maintenance / downtime schedules",
-			RequestQuery:        new(alertmanagertypes.ListPlannedMaintenanceParams),
-			Response:            make([]*alertmanagertypes.PlannedMaintenance, 0),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.DeleteRuleView), handler.OpenAPIDef{
+		ID:                  "DeleteRuleView",
+		Tags:                []string{"rules"},
+		Summary:             "Delete rule saved view",
+		Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusNoContent,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.GetDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "GetDowntimeScheduleByID",
-			Tags:                []string{"downtimeschedules"},
-			Summary:             "Get downtime schedule by ID",
-			Description:         "This endpoint returns a downtime schedule by ID",
-			Response:            new(alertmanagertypes.PlannedMaintenance),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusNotFound},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListDowntimeSchedules), handler.OpenAPIDef{
+		ID:                  "ListDowntimeSchedules",
+		Tags:                []string{"downtimeschedules"},
+		Summary:             "List downtime schedules",
+		Description:         "This endpoint lists all planned maintenance / downtime schedules",
+		RequestQuery:        new(alertmanagertypes.ListPlannedMaintenanceParams),
+		Response:            make([]*alertmanagertypes.PlannedMaintenance, 0),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/downtime_schedules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateDowntimeSchedule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                  "CreateDowntimeSchedule",
-			Tags:                []string{"downtimeschedules"},
-			Summary:             "Create downtime schedule",
-			Description:         "This endpoint creates a new planned maintenance / downtime schedule",
-			Request:             new(alertmanagertypes.PostablePlannedMaintenance),
-			RequestContentType:  "application/json",
-			Response:            new(alertmanagertypes.PlannedMaintenance),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusCreated,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes: newScopedSecuritySchemes([]string{
-				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbCreate),
-				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-			}),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
-				Verb:     coretypes.VerbCreate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.ResponseJSONPath("data.id"),
-				Selector: coretypes.WildcardSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
-				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
-				SourceSelector: coretypes.WildcardSelector,
-				TargetResource: coretypes.ResourceMetaResourceRule,
-				TargetIDs:      ruler.DowntimeRuleIDsExtractor,
-				TargetSelector: ruler.DowntimeRuleSelector,
-			},
-		),
-	)).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.GetDowntimeScheduleByID), handler.OpenAPIDef{
+		ID:                  "GetDowntimeScheduleByID",
+		Tags:                []string{"downtimeschedules"},
+		Summary:             "Get downtime schedule by ID",
+		Description:         "This endpoint returns a downtime schedule by ID",
+		Response:            new(alertmanagertypes.PlannedMaintenance),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                 "UpdateDowntimeScheduleByID",
-			Tags:               []string{"downtimeschedules"},
-			Summary:            "Update downtime schedule",
-			Description:        "This endpoint updates a downtime schedule by ID",
-			Request:            new(alertmanagertypes.PostablePlannedMaintenance),
-			RequestContentType: "application/json",
-			SuccessStatusCode:  http.StatusNoContent,
-			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes: newScopedSecuritySchemes([]string{
-				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbUpdate),
-				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbDetach),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
-			}),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
-				Verb:     coretypes.VerbUpdate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.PathParam("id"),
-				Selector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceRule,
-				TargetIDs:      ruler.NewDowntimeRuleAttachExtractor(provider.rulerService),
-				TargetSelector: ruler.DowntimeRuleSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbDetach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceRule,
-				TargetIDs:      ruler.NewDowntimeRuleDetachExtractor(provider.rulerService),
-				TargetSelector: ruler.DowntimeRuleSelector,
-			},
-		),
-	)).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CreateDowntimeSchedule), handler.OpenAPIDef{
+		ID:                  "CreateDowntimeSchedule",
+		Tags:                []string{"downtimeschedules"},
+		Summary:             "Create downtime schedule",
+		Description:         "This endpoint creates a new planned maintenance / downtime schedule",
+		Request:             new(alertmanagertypes.PostablePlannedMaintenance),
+		RequestContentType:  "application/json",
+		Response:            new(alertmanagertypes.PlannedMaintenance),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusCreated,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                "DeleteDowntimeScheduleByID",
-			Tags:              []string{"downtimeschedules"},
-			Summary:           "Delete downtime schedule",
-			Description:       "This endpoint deletes a downtime schedule by ID",
-			SuccessStatusCode: http.StatusNoContent,
-			ErrorStatusCodes:  []int{http.StatusNotFound},
-			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbDelete)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
-			Verb:     coretypes.VerbDelete,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.UpdateDowntimeScheduleByID), handler.OpenAPIDef{
+		ID:                 "UpdateDowntimeScheduleByID",
+		Tags:               []string{"downtimeschedules"},
+		Summary:            "Update downtime schedule",
+		Description:        "This endpoint updates a downtime schedule by ID",
+		Request:            new(alertmanagertypes.PostablePlannedMaintenance),
+		RequestContentType: "application/json",
+		SuccessStatusCode:  http.StatusNoContent,
+		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPut).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.DeleteDowntimeScheduleByID), handler.OpenAPIDef{
+		ID:                "DeleteDowntimeScheduleByID",
+		Tags:              []string{"downtimeschedules"},
+		Summary:           "Delete downtime schedule",
+		Description:       "This endpoint deletes a downtime schedule by ID",
+		SuccessStatusCode: http.StatusNoContent,
+		ErrorStatusCodes:  []int{http.StatusNotFound},
+		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

--- a/pkg/apiserver/signozapiserver/rulestatehistory.go
+++ b/pkg/apiserver/signozapiserver/rulestatehistory.go
@@ -4,10 +4,7 @@ import (
 	"net/http"

 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	"github.com/SigNoz/signoz/pkg/ruler"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/rulestatehistorytypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/gorilla/mux"
@@ -16,7 +13,7 @@ import (
 func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {

 	if err := router.Handle("/api/v2/rules/{id}/history/stats", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryStats, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryStats),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryStats",
 			Tags:                []string{"rules"},
@@ -27,21 +24,13 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v2/rules/{id}/history/timeline", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryTimeline, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryTimeline),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryTimeline",
 			Tags:                []string{"rules"},
@@ -52,26 +41,13 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}, handler.TelemetryResourceDef{
-			Verb:      coretypes.VerbRead,
-			Category:  coretypes.ActionCategoryDataAccess,
-			Selector:  querybuilder.TelemetrySelector,
-			Resources: ruler.NewRuleQueryTelemetryResources(provider.rulerService),
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v2/rules/{id}/history/top_contributors", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryContributors, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryContributors),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryTopContributors",
 			Tags:                []string{"rules"},
@@ -82,26 +58,13 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}, handler.TelemetryResourceDef{
-			Verb:      coretypes.VerbRead,
-			Category:  coretypes.ActionCategoryDataAccess,
-			Selector:  querybuilder.TelemetrySelector,
-			Resources: ruler.NewRuleQueryTelemetryResources(provider.rulerService),
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v2/rules/{id}/history/filter_keys", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryFilterKeys, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryFilterKeys),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryFilterKeys",
 			Tags:                []string{"rules"},
@@ -112,26 +75,13 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, buildFieldScopes(coretypes.VerbList)...)),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}, handler.TelemetryResourceDef{
-			Verb:      coretypes.VerbList,
-			Category:  coretypes.ActionCategoryDataAccess,
-			Selector:  coretypes.WildcardSelector,
-			Resources: ruler.NewRuleQueryFieldResources(provider.rulerService),
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v2/rules/{id}/history/filter_values", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryFilterValues, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryFilterValues),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryFilterValues",
 			Tags:                []string{"rules"},
@@ -142,26 +92,13 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, buildFieldScopes(coretypes.VerbRead)...)),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}, handler.TelemetryResourceDef{
-			Verb:      coretypes.VerbRead,
-			Category:  coretypes.ActionCategoryDataAccess,
-			Selector:  coretypes.WildcardSelector,
-			Resources: ruler.NewRuleQueryFieldResources(provider.rulerService),
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	if err := router.Handle("/api/v2/rules/{id}/history/overall_status", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryOverallStatus, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryOverallStatus),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryOverallStatus",
 			Tags:                []string{"rules"},
@@ -172,26 +109,10 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

 	return nil
 }
-
-func buildFieldScopes(verb coretypes.Verb) []string {
-	return []string{
-		coretypes.ResourceMetaResourceLogsField.Scope(verb),
-		coretypes.ResourceMetaResourceTracesField.Scope(verb),
-		coretypes.ResourceMetaResourceMetricsField.Scope(verb),
-	}
-}
--- a/pkg/http/handler/resourcedef.go
+++ b/pkg/http/handler/resourcedef.go
@@ -109,8 +109,6 @@ type TelemetryResourceDef struct {
 	Category  coretypes.ActionCategory
 	Selector  coretypes.SelectorFunc
 	Resources coretypes.ResourceExtractor
-	// Optional skips the check instead of failing when the request carries no telemetry resources.
-	Optional bool
 }

 func (def TelemetryResourceDef) resolveRequest(ec coretypes.ExtractorContext) []coretypes.ResolvedResource {
@@ -118,9 +116,6 @@ func (def TelemetryResourceDef) resolveRequest(ec coretypes.ExtractorContext) []
 	if err != nil {
 		return []coretypes.ResolvedResource{coretypes.NewResolvedResourceWithError(def.Verb, def.Category, err)}
 	}
-	if len(refs) == 0 && def.Optional {
-		return nil
-	}
 	if len(refs) == 0 {
 		return []coretypes.ResolvedResource{coretypes.NewResolvedResourceWithError(
 			def.Verb,
--- a/pkg/http/handler/resourcedef_test.go
+++ b/pkg/http/handler/resourcedef_test.go
@@ -69,43 +69,3 @@ func TestAttachDetachSiblingResourceDefKeepsEmptySingleID(t *testing.T) {
 	require.True(t, ok)
 	assert.Equal(t, []string{""}, withTarget.TargetIDs())
 }
-
-func TestTelemetryResourceDefWithoutResources(t *testing.T) {
-	testCases := []struct {
-		name     string
-		optional bool
-		wantLen  int
-		wantErr  bool
-	}{
-		{
-			name:     "Required_Errors",
-			optional: false,
-			wantLen:  1,
-			wantErr:  true,
-		},
-		{
-			name:     "Optional_ResolvesNothing",
-			optional: true,
-			wantLen:  0,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			def := TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  coretypes.WildcardSelector,
-				Resources: func(coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) { return nil, nil },
-				Optional:  testCase.optional,
-			}
-
-			resolved := ResolveRequest([]ResourceDef{def}, coretypes.ExtractorContext{})
-
-			require.Len(t, resolved, testCase.wantLen)
-			if testCase.wantErr {
-				assert.Error(t, resolved[0].Err())
-			}
-		})
-	}
-}
--- a/pkg/query-service/rules/manager.go
+++ b/pkg/query-service/rules/manager.go
@@ -1043,24 +1043,29 @@ func (m *Manager) PatchRule(ctx context.Context, ruleStr string, id valuer.UUID)
 		return nil, err
 	}

-	storedRule, err := ruletypes.NewPatchedPostableRule([]byte(storedJSON.Data), []byte(ruleStr))
-	if err != nil {
+	storedRule := ruletypes.PostableRule{}
+	if err := json.Unmarshal([]byte(storedJSON.Data), &storedRule); err != nil {
+		m.logger.ErrorContext(ctx, "failed to unmarshal rule from db", slog.String("rule.id", id.StringValue()), errors.Attr(err))
+		return nil, err
+	}
+
+	if err := json.Unmarshal([]byte(ruleStr), &storedRule); err != nil {
 		m.logger.ErrorContext(ctx, "failed to unmarshal patched rule with given id", slog.String("rule.id", id.StringValue()), errors.Attr(err))
 		return nil, err
 	}
 	if err := storedRule.Validate(); err != nil {
 		return nil, err
 	}
-	if err := m.validateChannels(ctx, claims.OrgID, storedRule); err != nil {
+	if err := m.validateChannels(ctx, claims.OrgID, &storedRule); err != nil {
 		return nil, err
 	}
 	// deploy or un-deploy task according to patched (new) rule state
-	if err := m.syncRuleStateWithTask(ctx, orgID, taskName, storedRule); err != nil {
+	if err := m.syncRuleStateWithTask(ctx, orgID, taskName, &storedRule); err != nil {
 		m.logger.ErrorContext(ctx, "failed to sync stored rule state with the task", slog.String("task.name", taskName), errors.Attr(err))
 		return nil, err
 	}

-	newStoredJson, err := json.Marshal(storedRule)
+	newStoredJson, err := json.Marshal(&storedRule)
 	if err != nil {
 		m.logger.ErrorContext(ctx, "failed to marshal new stored rule with given id", slog.String("rule.id", id.StringValue()), errors.Attr(err))
 		return nil, err
@@ -1073,7 +1078,7 @@ func (m *Manager) PatchRule(ctx context.Context, ruleStr string, id valuer.UUID)

 	err = m.ruleStore.EditRule(ctx, storedJSON, func(ctx context.Context) error { return nil })
 	if err != nil {
-		if err := m.syncRuleStateWithTask(ctx, orgID, taskName, storedRule); err != nil {
+		if err := m.syncRuleStateWithTask(ctx, orgID, taskName, &storedRule); err != nil {
 			m.logger.ErrorContext(ctx, "failed to restore rule after patch failure", "task_name", taskName, errors.Attr(err))
 		}
 		return nil, err
@@ -1082,7 +1087,7 @@ func (m *Manager) PatchRule(ctx context.Context, ruleStr string, id valuer.UUID)
 	// prepare http response
 	response := ruletypes.GettableRule{
 		Id:           id.StringValue(),
-		PostableRule: *storedRule,
+		PostableRule: storedRule,
 	}

 	// fetch state of rule from memory
--- a/pkg/ruler/authz.go
+++ b/pkg/ruler/authz.go
@@ -1,463 +0,0 @@
-package ruler
-
-import (
-	"context"
-	"encoding/json"
-
-	"github.com/SigNoz/signoz/pkg/alertmanager"
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/SigNoz/signoz/pkg/types/ruletypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/gorilla/mux"
-	"github.com/tidwall/gjson"
-)
-
-const (
-	attachedSide diffSide = iota
-	detachedSide
-)
-
-type diffSide int
-
-type incomingChannelsFunc func(stored *ruletypes.GettableRule, body []byte) ([]string, error)
-
-var DowntimeRuleIDsExtractor = coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-	ids, err := coretypes.BodyJSONArray("alertIds").Fn(ec)
-	if err != nil {
-		return nil, err
-	}
-
-	return defaultToAllRules(ids), nil
-}}
-
-var DowntimeRuleSelector coretypes.SelectorFunc = func(ctx context.Context, resource coretypes.Resource, id string, orgID valuer.UUID) ([]coretypes.Selector, error) {
-	if id == coretypes.WildCardSelectorString {
-		return coretypes.WildcardSelector(ctx, resource, id, orgID)
-	}
-
-	return coretypes.IDSelector(ctx, resource, id, orgID)
-}
-
-func NewDowntimeRuleAttachExtractor(rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newDowntimeDiffExtractor(rulerService, attachedSide)
-}
-
-func NewDowntimeRuleDetachExtractor(rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newDowntimeDiffExtractor(rulerService, detachedSide)
-}
-
-func newDowntimeDiffExtractor(rulerService Ruler, side diffSide) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		scheduleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
-		if err != nil {
-			return nil, err
-		}
-
-		stored, err := rulerService.MaintenanceStore().GetPlannedMaintenanceByID(ec.Request.Context(), scheduleID)
-		if err != nil {
-			return nil, err
-		}
-
-		incoming, err := DowntimeRuleIDsExtractor.Fn(ec)
-		if err != nil {
-			return nil, err
-		}
-
-		attached, detached := diffDowntimeRuleLinks(stored.RuleIDs, incoming)
-		if side == detachedSide {
-			return detached, nil
-		}
-
-		return attached, nil
-	}}
-}
-
-func NewCreateRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		ctx := ec.Request.Context()
-		orgID, err := orgIDFromContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		names, err := parseRuleChannels(ec.RequestBody)
-		if err != nil {
-			return nil, err
-		}
-
-		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), names)
-	}}
-}
-
-func NewCloneRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		ctx := ec.Request.Context()
-		orgID, err := orgIDFromContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		stored, err := fetchStoredRule(ec, rulerService)
-		if err != nil {
-			return nil, err
-		}
-
-		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), stored.Channels())
-	}}
-}
-
-func NewReplaceRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parseReplacedRuleChannels, attachedSide)
-}
-
-func NewReplaceRuleChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parseReplacedRuleChannels, detachedSide)
-}
-
-func NewPatchRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parsePatchedRuleChannels, attachedSide)
-}
-
-func NewPatchRuleChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parsePatchedRuleChannels, detachedSide)
-}
-
-func newRuleChannelDiffExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler, incoming incomingChannelsFunc, side diffSide) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		ctx := ec.Request.Context()
-		orgID, err := orgIDFromContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		stored, err := fetchStoredRule(ec, rulerService)
-		if err != nil {
-			return nil, err
-		}
-
-		incomingNames, err := incoming(stored, ec.RequestBody)
-		if err != nil {
-			return nil, err
-		}
-
-		attached, detached := diffLinks(stored.Channels(), incomingNames)
-		if side == detachedSide {
-			return resolveStoredChannelIDs(ctx, alertmanagerService, orgID, detached)
-		}
-
-		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), attached)
-	}}
-}
-
-func parseReplacedRuleChannels(_ *ruletypes.GettableRule, body []byte) ([]string, error) {
-	return parseRuleChannels(body)
-}
-
-func parsePatchedRuleChannels(stored *ruletypes.GettableRule, body []byte) ([]string, error) {
-	patched, err := applyRulePatch(stored, body)
-	if err != nil {
-		return nil, err
-	}
-
-	return patched.Channels(), nil
-}
-
-func applyRulePatch(stored *ruletypes.GettableRule, body []byte) (*ruletypes.PostableRule, error) {
-	encoded, err := json.Marshal(stored.PostableRule)
-	if err != nil {
-		return nil, err
-	}
-
-	return ruletypes.NewPatchedPostableRule(encoded, body)
-}
-
-func parseRuleChannels(body []byte) ([]string, error) {
-	rule := new(ruletypes.PostableRule)
-	if err := json.Unmarshal(body, rule); err != nil {
-		return nil, err
-	}
-
-	return rule.Channels(), nil
-}
-
-func diffDowntimeRuleLinks(stored, incoming []string) (attached, detached []string) {
-	return diffLinks(defaultToAllRules(stored), incoming)
-}
-
-func defaultToAllRules(ids []string) []string {
-	if len(ids) == 0 {
-		return []string{coretypes.WildCardSelectorString}
-	}
-
-	return ids
-}
-
-func NewCreateRoutePolicyChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		ctx := ec.Request.Context()
-		orgID, err := orgIDFromContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		names, err := coretypes.BodyJSONArray("channels").Fn(ec)
-		if err != nil {
-			return nil, err
-		}
-
-		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), names)
-	}}
-}
-
-func NewUpdateRoutePolicyChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
-	return newRoutePolicyDiffExtractor(alertmanagerService, attachedSide)
-}
-
-func NewUpdateRoutePolicyChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
-	return newRoutePolicyDiffExtractor(alertmanagerService, detachedSide)
-}
-
-func newRoutePolicyDiffExtractor(alertmanagerService alertmanager.Alertmanager, side diffSide) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		ctx := ec.Request.Context()
-		orgID, err := orgIDFromContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		stored, err := alertmanagerService.GetRoutePolicyByID(ctx, mux.Vars(ec.Request)["id"])
-		if err != nil {
-			return nil, err
-		}
-
-		incoming, err := coretypes.BodyJSONArray("channels").Fn(ec)
-		if err != nil {
-			return nil, err
-		}
-
-		attached, detached := diffLinks(stored.Channels, incoming)
-		if side == detachedSide {
-			return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), detached)
-		}
-
-		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), attached)
-	}}
-}
-
-func resolveStoredChannelIDs(ctx context.Context, alertmanagerService alertmanager.Alertmanager, orgID valuer.UUID, names []string) ([]string, error) {
-	if len(names) == 0 {
-		return nil, nil
-	}
-
-	idByName, err := mapChannelIDsByName(ctx, alertmanagerService, orgID)
-	if err != nil {
-		return nil, err
-	}
-
-	ids := make([]string, 0, len(names))
-	for _, name := range names {
-		if id, ok := idByName[name]; ok {
-			ids = append(ids, id)
-		}
-	}
-
-	return ids, nil
-}
-
-func mapChannelIDsByName(ctx context.Context, alertmanagerService alertmanager.Alertmanager, orgID valuer.UUID) (map[string]string, error) {
-	channels, err := alertmanagerService.ListChannels(ctx, orgID.StringValue())
-	if err != nil {
-		return nil, err
-	}
-
-	idByName := make(map[string]string, len(channels))
-	for _, channel := range channels {
-		idByName[channel.DisplayName] = channel.ID.StringValue()
-	}
-
-	return idByName, nil
-}
-
-func orgIDFromContext(ctx context.Context) (valuer.UUID, error) {
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		return valuer.UUID{}, err
-	}
-
-	return valuer.NewUUID(claims.OrgID)
-}
-
-func NewRuleQueryTelemetryResources(rulerService Ruler) coretypes.ResourceExtractor {
-	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
-		body, err := fetchStoredCompositeQuery(ec, rulerService)
-		if err != nil {
-			return nil, err
-		}
-
-		return querybuilder.QueryRangeResources(coretypes.ExtractorContext{Request: ec.Request, RequestBody: body})
-	}
-}
-
-func NewRuleQueryFieldResources(rulerService Ruler) coretypes.ResourceExtractor {
-	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
-		body, err := fetchStoredCompositeQuery(ec, rulerService)
-		if err != nil {
-			return nil, err
-		}
-
-		return mapFieldResources(body)
-	}
-}
-
-func NewRuleBodyTelemetryResources() coretypes.ResourceExtractor {
-	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
-		compositeQuery := gjson.GetBytes(ec.RequestBody, "condition.compositeQuery")
-		if !compositeQuery.Exists() {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "condition.compositeQuery is required")
-		}
-
-		body, err := json.Marshal(map[string]json.RawMessage{"compositeQuery": json.RawMessage(compositeQuery.Raw)})
-		if err != nil {
-			return nil, err
-		}
-
-		return querybuilder.QueryRangeResources(coretypes.ExtractorContext{Request: ec.Request, RequestBody: body})
-	}
-}
-
-func NewOptionalRuleBodyTelemetryResources() coretypes.ResourceExtractor {
-	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
-		if !gjson.GetBytes(ec.RequestBody, "condition.compositeQuery").Exists() {
-			return nil, nil
-		}
-
-		return NewRuleBodyTelemetryResources()(ec)
-	}
-}
-
-func fetchStoredRule(ec coretypes.ExtractorContext, rulerService Ruler) (*ruletypes.GettableRule, error) {
-	ruleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
-	if err != nil {
-		return nil, err
-	}
-
-	return rulerService.GetRule(ec.Request.Context(), ruleID)
-}
-
-func fetchStoredCompositeQuery(ec coretypes.ExtractorContext, rulerService Ruler) ([]byte, error) {
-	if ec.Request == nil {
-		return nil, nil
-	}
-
-	stored, err := fetchStoredRule(ec, rulerService)
-	if err != nil {
-		return nil, err
-	}
-
-	return json.Marshal(map[string]any{"compositeQuery": stored.RuleCondition.CompositeQuery})
-}
-
-func mapFieldResources(body []byte) ([]coretypes.ResourceWithID, error) {
-	telemetry, err := querybuilder.QueryRangeResources(coretypes.ExtractorContext{RequestBody: body})
-	if err != nil {
-		return nil, err
-	}
-
-	seen := make(map[string]struct{}, 3)
-	refs := make([]coretypes.ResourceWithID, 0, 3)
-	for _, ref := range telemetry {
-		field, err := fieldResourceForKind(ref.Resource.Kind())
-		if err != nil {
-			return nil, err
-		}
-
-		kind := field.Kind().String()
-		if _, ok := seen[kind]; ok {
-			continue
-		}
-		seen[kind] = struct{}{}
-		refs = append(refs, coretypes.ResourceWithID{Resource: field})
-	}
-
-	return refs, nil
-}
-
-func fieldResourceForKind(kind coretypes.Kind) (coretypes.Resource, error) {
-	switch kind {
-	case coretypes.KindLogs, coretypes.KindAuditLogs:
-		return coretypes.ResourceMetaResourceLogsField, nil
-	case coretypes.KindTraces:
-		return coretypes.ResourceMetaResourceTracesField, nil
-	case coretypes.KindMetrics, coretypes.KindMeterMetrics:
-		return coretypes.ResourceMetaResourceMetricsField, nil
-	default:
-		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "no field resource for telemetry kind %q", kind.String())
-	}
-}
-
-func diffLinks(stored, incoming []string) (attached, detached []string) {
-	storedSet := make(map[string]struct{}, len(stored))
-	for _, id := range stored {
-		storedSet[id] = struct{}{}
-	}
-
-	incomingSet := make(map[string]struct{}, len(incoming))
-	for _, id := range incoming {
-		incomingSet[id] = struct{}{}
-	}
-
-	seen := make(map[string]struct{}, len(incoming))
-	attached = make([]string, 0, len(incoming))
-	for _, id := range incoming {
-		if _, ok := storedSet[id]; ok {
-			continue
-		}
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		attached = append(attached, id)
-	}
-
-	clear(seen)
-	detached = make([]string, 0, len(stored))
-	for _, id := range stored {
-		if _, ok := incomingSet[id]; ok {
-			continue
-		}
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		detached = append(detached, id)
-	}
-
-	return attached, detached
-}
--- a/pkg/ruler/authz_test.go
+++ b/pkg/ruler/authz_test.go
@@ -1,588 +0,0 @@
-package ruler
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-
-	"github.com/SigNoz/signoz/pkg/alertmanager/alertmanagertest"
-	"github.com/SigNoz/signoz/pkg/types"
-	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/SigNoz/signoz/pkg/types/ruletypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDiffLinks(t *testing.T) {
-	testCases := []struct {
-		name         string
-		stored       []string
-		incoming     []string
-		wantAttached []string
-		wantDetached []string
-	}{
-		{
-			name:         "BothEmpty_NothingChanges",
-			wantAttached: []string{},
-			wantDetached: []string{},
-		},
-		{
-			name:         "NoStored_EverythingAttaches",
-			incoming:     []string{"slack", "pager"},
-			wantAttached: []string{"slack", "pager"},
-			wantDetached: []string{},
-		},
-		{
-			name:         "NoIncoming_EverythingDetaches",
-			stored:       []string{"slack", "pager"},
-			wantAttached: []string{},
-			wantDetached: []string{"slack", "pager"},
-		},
-		{
-			name:         "Unchanged_NothingChanges",
-			stored:       []string{"slack", "pager"},
-			incoming:     []string{"pager", "slack"},
-			wantAttached: []string{},
-			wantDetached: []string{},
-		},
-		{
-			name:         "OneAddedOneRemoved_BothSidesReported",
-			stored:       []string{"slack", "pager"},
-			incoming:     []string{"slack", "email"},
-			wantAttached: []string{"email"},
-			wantDetached: []string{"pager"},
-		},
-		{
-			name:         "DuplicateIncoming_CollapsedOnce",
-			incoming:     []string{"slack", "slack"},
-			wantAttached: []string{"slack"},
-			wantDetached: []string{},
-		},
-		{
-			name:         "DuplicateStored_CollapsedOnce",
-			stored:       []string{"pager", "pager"},
-			wantAttached: []string{},
-			wantDetached: []string{"pager"},
-		},
-		{
-			name:         "IncomingOrderPreserved",
-			stored:       []string{"keep"},
-			incoming:     []string{"zebra", "keep", "apple"},
-			wantAttached: []string{"zebra", "apple"},
-			wantDetached: []string{},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			attached, detached := diffLinks(testCase.stored, testCase.incoming)
-
-			assert.Equal(t, testCase.wantAttached, attached)
-			assert.Equal(t, testCase.wantDetached, detached)
-		})
-	}
-}
-
-func TestDiffDowntimeRuleLinks(t *testing.T) {
-	testCases := []struct {
-		name         string
-		stored       []string
-		incoming     []string
-		wantAttached []string
-		wantDetached []string
-	}{
-		{
-			name:         "AllToAll_NoChange",
-			stored:       nil,
-			incoming:     []string{"*"},
-			wantAttached: []string{},
-			wantDetached: []string{},
-		},
-		{
-			name:         "NarrowFromAllToOne_DetachesAllAttachesOne",
-			stored:       nil,
-			incoming:     []string{"r1"},
-			wantAttached: []string{"r1"},
-			wantDetached: []string{"*"},
-		},
-		{
-			name:         "WidenFromOneToAll_DetachesOneAttachesAll",
-			stored:       []string{"r1"},
-			incoming:     []string{"*"},
-			wantAttached: []string{"*"},
-			wantDetached: []string{"r1"},
-		},
-		{
-			name:         "SwapRules_DiffsIDs",
-			stored:       []string{"r1"},
-			incoming:     []string{"r2"},
-			wantAttached: []string{"r2"},
-			wantDetached: []string{"r1"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			attached, detached := diffDowntimeRuleLinks(testCase.stored, testCase.incoming)
-
-			assert.ElementsMatch(t, testCase.wantAttached, attached)
-			assert.ElementsMatch(t, testCase.wantDetached, detached)
-		})
-	}
-}
-
-func TestDowntimeRuleIDsExtractor(t *testing.T) {
-	testCases := []struct {
-		name    string
-		body    string
-		wantIDs []string
-	}{
-		{
-			name:    "MissingAlertIds_AllRules",
-			body:    `{"name": "window"}`,
-			wantIDs: []string{"*"},
-		},
-		{
-			name:    "EmptyAlertIds_AllRules",
-			body:    `{"alertIds": []}`,
-			wantIDs: []string{"*"},
-		},
-		{
-			name:    "ExplicitAlertIds_Kept",
-			body:    `{"alertIds": ["r1", "r2"]}`,
-			wantIDs: []string{"r1", "r2"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			ids, err := DowntimeRuleIDsExtractor.Fn(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
-
-			require.NoError(t, err)
-			assert.Equal(t, testCase.wantIDs, ids)
-		})
-	}
-}
-
-func TestMapFieldResources(t *testing.T) {
-	testCases := []struct {
-		name      string
-		body      string
-		wantKinds []coretypes.Kind
-		wantErr   bool
-	}{
-		{
-			name:      "Builder_Logs_LogsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindLogsField},
-		},
-		{
-			name:      "Builder_Traces_TracesField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"traces"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindTracesField},
-		},
-		{
-			name:      "Builder_Metrics_MetricsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"metrics"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
-		},
-		{
-			name:      "SubQuery_Metrics_MetricsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_sub_query","spec":{"signal":"metrics"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
-		},
-		{
-			name:      "BuilderAI_TracesField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_ai_query","spec":{}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindTracesField},
-		},
-		{
-			name:      "PromQL_MetricsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"promql","spec":{}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
-		},
-		{
-			name:      "ClickHouseSQL_AllThreeFields",
-			body:      `{"compositeQuery":{"queries":[{"type":"clickhouse_sql","spec":{}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindLogsField, coretypes.KindTracesField, coretypes.KindMetricsField},
-		},
-		{
-			name:      "Builder_AuditLogs_LogsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs","source":"audit"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindLogsField},
-		},
-		{
-			name:      "Builder_MeterMetrics_MetricsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"metrics","source":"meter"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
-		},
-		{
-			name:      "TwoBuilderSameSignal_Deduped",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"metrics"}},{"type":"builder_query","spec":{"signal":"metrics"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
-		},
-		{
-			name:      "FormulaAlongsideBuilder_FormulaSkipped",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs"}},{"type":"builder_formula","spec":{}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindLogsField},
-		},
-		{
-			name:    "NoQueries_Errors",
-			body:    `{"compositeQuery":{"queries":[]}}`,
-			wantErr: true,
-		},
-		{
-			name:    "UnknownSignal_Errors",
-			body:    `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"events"}}]}}`,
-			wantErr: true,
-		},
-		{
-			name:    "UnknownQueryType_Errors",
-			body:    `{"compositeQuery":{"queries":[{"type":"graphql","spec":{}}]}}`,
-			wantErr: true,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			refs, err := mapFieldResources([]byte(testCase.body))
-
-			if testCase.wantErr {
-				assert.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			kinds := make([]coretypes.Kind, 0, len(refs))
-			for _, ref := range refs {
-				kinds = append(kinds, ref.Resource.Kind())
-			}
-			assert.Equal(t, testCase.wantKinds, kinds)
-		})
-	}
-}
-
-func v1RuleJSON(preferredChannels string) string {
-	return `{
-		"alert": "TestAlert",
-		"version": "v5",
-		"condition": {
-			"compositeQuery": {
-				"queryType": "builder",
-				"queries": [{
-					"type": "builder_query",
-					"spec": {
-						"name": "A",
-						"signal": "metrics",
-						"aggregations": [{"metricName": "cpu", "spaceAggregation": "p50"}],
-						"stepInterval": "5m"
-					}
-				}]
-			},
-			"target": 10.0,
-			"matchType": "1",
-			"op": "1"
-		}` + preferredChannels + `
-	}`
-}
-
-func v2RuleJSON(channels string) string {
-	return `{
-		"alert": "TestAlert",
-		"version": "v5",
-		"schemaVersion": "v2alpha1",
-		"ruleType": "threshold_rule",
-		"condition": {
-			"compositeQuery": {
-				"queryType": "builder",
-				"queries": [{
-					"type": "builder_query",
-					"spec": {
-						"name": "A",
-						"signal": "metrics",
-						"aggregations": [{"metricName": "cpu", "spaceAggregation": "p50"}],
-						"stepInterval": "5m"
-					}
-				}]
-			},
-			"thresholds": {
-				"kind": "basic",
-				"spec": [{"name": "critical", "target": 90.0, "matchType": "1", "op": "1", "channels": ` + channels + `}]
-			}
-		},
-		"evaluation": {
-			"kind": "rolling",
-			"spec": {"evalWindow": "5m", "frequency": "1m"}
-		},
-		"notificationSettings": {
-			"renotify": {"enabled": true, "interval": "4h", "alertStates": ["firing"]}
-		}
-	}`
-}
-
-func TestParseRuleChannels(t *testing.T) {
-	testCases := []struct {
-		name         string
-		body         string
-		wantChannels []string
-		wantErr      bool
-	}{
-		{
-			name:         "V1PreferredChannels_FoldedIntoThresholds",
-			body:         v1RuleJSON(`, "preferredChannels": ["slack", "pager"]`),
-			wantChannels: []string{"slack", "pager"},
-		},
-		{
-			name:         "V1NoChannels_Empty",
-			body:         v1RuleJSON(""),
-			wantChannels: nil,
-		},
-		{
-			name:         "V2ThresholdChannels_ReadDirectly",
-			body:         v2RuleJSON(`["email"]`),
-			wantChannels: []string{"email"},
-		},
-		{
-			name:         "V2EmptyChannels_Empty",
-			body:         v2RuleJSON(`[]`),
-			wantChannels: nil,
-		},
-		{
-			name:    "NotJSON_Errors",
-			body:    "not json",
-			wantErr: true,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			channels, err := parseRuleChannels([]byte(testCase.body))
-
-			if testCase.wantErr {
-				assert.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, testCase.wantChannels, channels)
-		})
-	}
-}
-
-func TestIncomingRuleChannels(t *testing.T) {
-	testCases := []struct {
-		name            string
-		incoming        incomingChannelsFunc
-		stored          string
-		body            string
-		wantChannels    []string
-		wantStoredAfter []string
-	}{
-		{
-			name:            "Replaced_IgnoresStored",
-			incoming:        parseReplacedRuleChannels,
-			stored:          v2RuleJSON(`["slack"]`),
-			body:            v2RuleJSON(`["pager"]`),
-			wantChannels:    []string{"pager"},
-			wantStoredAfter: []string{"slack"},
-		},
-		{
-			name:            "Patched_OmitsCondition_StoredChannelsSurvive",
-			incoming:        parsePatchedRuleChannels,
-			stored:          v2RuleJSON(`["slack"]`),
-			body:            `{"disabled": true}`,
-			wantChannels:    []string{"slack"},
-			wantStoredAfter: []string{"slack"},
-		},
-		{
-			name:            "Patched_SetsChannels_StoredChannelsReplaced",
-			incoming:        parsePatchedRuleChannels,
-			stored:          v2RuleJSON(`["slack"]`),
-			body:            v2RuleJSON(`["pager"]`),
-			wantChannels:    []string{"pager"},
-			wantStoredAfter: []string{"slack"},
-		},
-		{
-			name:            "Patched_EmptiesChannels_NoChannelsLeft",
-			incoming:        parsePatchedRuleChannels,
-			stored:          v2RuleJSON(`["slack"]`),
-			body:            v2RuleJSON(`[]`),
-			wantChannels:    nil,
-			wantStoredAfter: []string{"slack"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			stored := new(ruletypes.GettableRule)
-			require.NoError(t, json.Unmarshal([]byte(testCase.stored), &stored.PostableRule))
-
-			channels, err := testCase.incoming(stored, []byte(testCase.body))
-
-			require.NoError(t, err)
-			assert.Equal(t, testCase.wantChannels, channels)
-			assert.Equal(t, testCase.wantStoredAfter, stored.Channels())
-		})
-	}
-}
-
-func TestRuleBodyTelemetryResources(t *testing.T) {
-	testCases := []struct {
-		name     string
-		body     string
-		wantKind coretypes.Kind
-		wantID   string
-		wantErr  bool
-	}{
-		{
-			name:     "V5Body_NoFilter_MetricsWildcard",
-			body:     v2RuleJSON(`[]`),
-			wantKind: coretypes.KindMetrics,
-			wantID:   "builder_query/*",
-		},
-		{
-			name:     "V1Body_PreferredChannels_MetricsWildcard",
-			body:     v1RuleJSON(`, "preferredChannels": ["slack"]`),
-			wantKind: coretypes.KindMetrics,
-			wantID:   "builder_query/*",
-		},
-		{
-			name:    "MissingCondition_Errors",
-			body:    `{"alert": "TestAlert", "version": "v5"}`,
-			wantErr: true,
-		},
-		{
-			name:    "NotJSON_Errors",
-			body:    "not json",
-			wantErr: true,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			refs, err := NewRuleBodyTelemetryResources()(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
-
-			if testCase.wantErr {
-				assert.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			require.Len(t, refs, 1)
-			assert.Equal(t, testCase.wantKind, refs[0].Resource.Kind())
-			assert.Equal(t, testCase.wantID, refs[0].ID)
-		})
-	}
-}
-
-func TestApplyRulePatch(t *testing.T) {
-	logsQuery := `{"condition": {"compositeQuery": {"queryType": "builder", "queries": [{"type": "builder_query", "spec": {"name": "A", "signal": "logs", "stepInterval": "5m"}}]}}}`
-	testCases := []struct {
-		name         string
-		body         string
-		wantSignal   string
-		wantChannels []string
-	}{
-		{
-			name:         "BodyWithoutCondition_KeepsStoredQueryAndChannels",
-			body:         `{"disabled": true}`,
-			wantSignal:   "metrics",
-			wantChannels: []string{"slack"},
-		},
-		{
-			name:         "BodyWithNewQuery_ReplacesSignalKeepsThresholds",
-			body:         logsQuery,
-			wantSignal:   "logs",
-			wantChannels: []string{"slack"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			stored := new(ruletypes.GettableRule)
-			require.NoError(t, json.Unmarshal([]byte(v2RuleJSON(`["slack"]`)), &stored.PostableRule))
-
-			patched, err := applyRulePatch(stored, []byte(testCase.body))
-
-			require.NoError(t, err)
-			require.NotNil(t, patched.RuleCondition)
-			require.NotNil(t, patched.RuleCondition.CompositeQuery)
-			encoded, err := json.Marshal(patched.RuleCondition.CompositeQuery)
-			require.NoError(t, err)
-			assert.Contains(t, string(encoded), `"signal":"`+testCase.wantSignal+`"`)
-			assert.Equal(t, testCase.wantChannels, patched.Channels())
-		})
-	}
-}
-
-func TestOptionalRuleBodyTelemetryResources(t *testing.T) {
-	testCases := []struct {
-		name     string
-		body     string
-		wantRefs int
-	}{
-		{
-			name:     "BodyWithoutCondition_NoResources",
-			body:     `{"disabled": true}`,
-			wantRefs: 0,
-		},
-		{
-			name:     "BodyWithQuery_MetricsResource",
-			body:     v2RuleJSON(`[]`),
-			wantRefs: 1,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			refs, err := NewOptionalRuleBodyTelemetryResources()(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
-
-			require.NoError(t, err)
-			assert.Len(t, refs, testCase.wantRefs)
-		})
-	}
-}
-
-func TestResolveStoredChannelIDs(t *testing.T) {
-	channels := []*alertmanagertypes.Channel{
-		{Identifiable: types.Identifiable{ID: valuer.GenerateUUID()}, Name: "slack", DisplayName: "slack"},
-	}
-	testCases := []struct {
-		name    string
-		names   []string
-		wantIDs []string
-	}{
-		{
-			name:    "KnownName_Resolved",
-			names:   []string{"slack"},
-			wantIDs: []string{channels[0].ID.StringValue()},
-		},
-		{
-			name:    "UnknownName_Skipped",
-			names:   []string{"slack", "gone"},
-			wantIDs: []string{channels[0].ID.StringValue()},
-		},
-		{
-			name:    "NoNames_NoLookup",
-			names:   nil,
-			wantIDs: nil,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			alertmanagerService := alertmanagertest.NewMockAlertmanager(t)
-			if len(testCase.names) > 0 {
-				alertmanagerService.EXPECT().ListChannels(mock.Anything, mock.Anything).Return(channels, nil)
-			}
-
-			ids, err := resolveStoredChannelIDs(context.Background(), alertmanagerService, valuer.GenerateUUID(), testCase.names)
-
-			require.NoError(t, err)
-			assert.Equal(t, testCase.wantIDs, ids)
-		})
-	}
-}
--- a/pkg/signoz/openapi.go
+++ b/pkg/signoz/openapi.go
@@ -100,12 +100,10 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ rulestatehistory.Handler }{},
 		struct{ spanmapper.Handler }{},
 		struct{ alertmanager.Handler }{},
-		struct{ alertmanager.Alertmanager }{},
 		struct{ prometheus.Handler }{},
 		struct{ llmpricingrule.Handler }{},
 		struct{ tracedetail.Handler }{},
 		struct{ ruler.Handler }{},
-		struct{ ruler.Ruler }{},
 		struct{ statsreporter.Handler }{},
 		struct{ savedview.Handler }{},
 		global.Config{},
--- a/pkg/signoz/provider.go
+++ b/pkg/signoz/provider.go
@@ -48,7 +48,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/prometheus/clickhouseprometheusv2"
 	"github.com/SigNoz/signoz/pkg/querier"
 	"github.com/SigNoz/signoz/pkg/querier/signozquerier"
-	"github.com/SigNoz/signoz/pkg/ruler"
 	"github.com/SigNoz/signoz/pkg/sharder"
 	"github.com/SigNoz/signoz/pkg/sharder/noopsharder"
 	"github.com/SigNoz/signoz/pkg/sharder/singlesharder"
@@ -266,9 +265,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewBackfillTelegramChannelSpecFactory(),
 		sqlmigration.NewAddMetricsFieldTuplesFactory(sqlstore),
 		sqlmigration.NewAddGCPConnectionMethodFactory(),
-		sqlmigration.NewAddRoutePolicyTuplesFactory(sqlstore),
-		sqlmigration.NewAddDowntimeTuplesFactory(sqlstore),
-		sqlmigration.NewAddRuleTuplesFactory(sqlstore),
+		sqlmigration.NewAddLLMPricingRuleTuplesFactory(sqlstore),
 	)
 }

@@ -333,7 +330,7 @@ func NewQuerierProviderFactories(telemetryStore telemetrystore.TelemetryStore, p
 	)
 }

-func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway, identNResolver identn.IdentNResolver, sharder sharder.Sharder, auditor auditor.Auditor, web web.Web, alertmanagerService alertmanager.Alertmanager, rulerService ruler.Ruler) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
+func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway, identNResolver identn.IdentNResolver, sharder sharder.Sharder, auditor auditor.Auditor, web web.Web) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
 	return factory.MustNewNamedMap(
 		signozapiserver.NewFactory(
 			orgGetter,
@@ -370,12 +367,10 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.RuleStateHistory,
 			handlers.SpanMapperHandler,
 			handlers.AlertmanagerHandler,
-			alertmanagerService,
 			handlers.PrometheusHandler,
 			handlers.LLMPricingRuleHandler,
 			handlers.TraceDetail,
 			handlers.RulerHandler,
-			rulerService,
 			handlers.StatsHandler,
 			handlers.SavedView,
 			globalConfig,
--- a/pkg/signoz/provider_test.go
+++ b/pkg/signoz/provider_test.go
@@ -106,8 +106,6 @@ func TestNewProviderFactories(t *testing.T) {
 			nil,
 			nil,
 			nil,
-			nil,
-			nil,
 		)
 	})
 }
--- a/pkg/signoz/signoz.go
+++ b/pkg/signoz/signoz.go
@@ -622,7 +622,7 @@ func New(
 		ctx,
 		providerSettings,
 		config.APIServer,
-		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway, identNResolver, sharder, auditor, web, alertmanager, rulerInstance),
+		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway, identNResolver, sharder, auditor, web),
 		"signoz",
 	)
 	if err != nil {
--- a/pkg/sqlmigration/139_add_llm_pricing_rule_tuples.go
+++ b/pkg/sqlmigration/139_add_llm_pricing_rule_tuples.go
@@ -16,21 +16,21 @@ import (
 	"github.com/uptrace/bun/migrate"
 )

-type addDowntimeTuples struct {
+type addLLMPricingRuleTuples struct {
 	sqlstore sqlstore.SQLStore
 }

-func NewAddDowntimeTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_downtime_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addDowntimeTuples{sqlstore: sqlstore}, nil
+func NewAddLLMPricingRuleTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_llm_pricing_rule_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addLLMPricingRuleTuples{sqlstore: sqlstore}, nil
 	})
 }

-func (migration *addDowntimeTuples) Register(migrations *migrate.Migrations) error {
+func (migration *addLLMPricingRuleTuples) Register(migrations *migrate.Migrations) error {
 	return migrations.Register(migration.Up, migration.Down)
 }

-func (migration *addDowntimeTuples) Up(ctx context.Context, db *bun.DB) error {
+func (migration *addLLMPricingRuleTuples) Up(ctx context.Context, db *bun.DB) error {
 	tx, err := db.BeginTx(ctx, nil)
 	if err != nil {
 		return err
@@ -54,27 +54,15 @@ func (migration *addDowntimeTuples) Up(ctx context.Context, db *bun.DB) error {

 	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG

-	crudVerbs := []string{"create", "read", "update", "delete", "list"}
-	readVerbs := []string{"read", "list"}
-	linkVerbs := []string{"attach", "detach"}
-
-	tuples := make([]migrationTuple, 0, 20)
-	for _, verb := range crudVerbs {
-		tuples = append(tuples,
-			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "planned-maintenance", verb},
-			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "planned-maintenance", verb},
-		)
-	}
-	for _, verb := range readVerbs {
-		tuples = append(tuples, migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "planned-maintenance", verb})
-	}
-	for _, objectName := range []string{"planned-maintenance", "rule"} {
-		for _, verb := range linkVerbs {
-			tuples = append(tuples,
-				migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", objectName, verb},
-				migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", objectName, verb},
-			)
-		}
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "list"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "list"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "list"},
 	}

 	for _, orgID := range orgIDs {
@@ -169,6 +157,6 @@ func (migration *addDowntimeTuples) Up(ctx context.Context, db *bun.DB) error {
 	return tx.Commit()
 }

-func (migration *addDowntimeTuples) Down(context.Context, *bun.DB) error {
+func (migration *addLLMPricingRuleTuples) Down(context.Context, *bun.DB) error {
 	return nil
 }
--- a/pkg/sqlmigration/139_add_route_policy_tuples.go
+++ b/pkg/sqlmigration/139_add_route_policy_tuples.go
@@ -1,173 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/oklog/ulid/v2"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/dialect"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addRoutePolicyTuples struct {
-	sqlstore sqlstore.SQLStore
-}
-
-func NewAddRoutePolicyTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_route_policy_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addRoutePolicyTuples{sqlstore: sqlstore}, nil
-	})
-}
-
-func (migration *addRoutePolicyTuples) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addRoutePolicyTuples) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	var storeID string
-	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
-	if err != nil {
-		return err
-	}
-
-	var orgIDs []string
-	err = tx.NewSelect().
-		Table("organizations").
-		Column("id").
-		Scan(ctx, &orgIDs)
-	if err != nil && err != sql.ErrNoRows {
-		return err
-	}
-
-	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
-
-	crudVerbs := []string{"create", "read", "update", "delete", "list"}
-	readVerbs := []string{"read", "list"}
-	linkVerbs := []string{"attach", "detach"}
-
-	tuples := make([]migrationTuple, 0, 15)
-	for _, verb := range crudVerbs {
-		tuples = append(tuples, migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "route-policy", verb})
-	}
-	for _, verb := range readVerbs {
-		tuples = append(tuples,
-			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "route-policy", verb},
-			migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "route-policy", verb},
-		)
-	}
-	for _, verb := range linkVerbs {
-		tuples = append(tuples,
-			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "route-policy", verb},
-			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "notification-channel", verb},
-			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "notification-channel", verb},
-		)
-	}
-
-	for _, orgID := range orgIDs {
-		for _, tuple := range tuples {
-			entropy := ulid.DefaultEntropy()
-			now := time.Now().UTC()
-			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
-
-			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
-			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
-
-			if isPG {
-				user := "role:" + roleSubject + "#assignee"
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			} else {
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			}
-		}
-	}
-
-	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
-	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
-		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
-		if err != nil {
-			return err
-		}
-		managedRoleGroups[roleName] = string(data)
-	}
-
-	for _, orgID := range orgIDs {
-		for roleName, data := range managedRoleGroups {
-			if _, err := tx.NewUpdate().
-				Model(new(roles)).
-				Set("transaction_groups = ?", data).
-				Where("org_id = ?", orgID).
-				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
-				Where("name = ?", roleName).
-				Exec(ctx); err != nil {
-				return err
-			}
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addRoutePolicyTuples) Down(context.Context, *bun.DB) error {
-	return nil
-}
--- a/pkg/sqlmigration/141_add_rule_tuples.go
+++ b/pkg/sqlmigration/141_add_rule_tuples.go
@@ -1,140 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-	"database/sql"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/oklog/ulid/v2"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/dialect"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addRuleTuples struct {
-	sqlstore sqlstore.SQLStore
-}
-
-func NewAddRuleTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_rule_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addRuleTuples{sqlstore: sqlstore}, nil
-	})
-}
-
-func (migration *addRuleTuples) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addRuleTuples) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	var storeID string
-	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
-	if err != nil {
-		return err
-	}
-
-	var orgIDs []string
-	err = tx.NewSelect().
-		Table("organizations").
-		Column("id").
-		Scan(ctx, &orgIDs)
-	if err != nil && err != sql.ErrNoRows {
-		return err
-	}
-
-	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
-
-	crudVerbs := []string{"create", "read", "update", "delete", "list"}
-	readVerbs := []string{"read", "list"}
-
-	tuples := make([]migrationTuple, 0, 12)
-	for _, verb := range crudVerbs {
-		tuples = append(tuples,
-			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "rule", verb},
-			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "rule", verb},
-		)
-	}
-	for _, verb := range readVerbs {
-		tuples = append(tuples, migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "rule", verb})
-	}
-
-	for _, orgID := range orgIDs {
-		for _, tuple := range tuples {
-			entropy := ulid.DefaultEntropy()
-			now := time.Now().UTC()
-			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
-
-			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
-			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
-
-			if isPG {
-				user := "role:" + roleSubject + "#assignee"
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			} else {
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			}
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addRuleTuples) Down(context.Context, *bun.DB) error {
-	return nil
-}
--- a/pkg/types/alertmanagertypes/channel.go
+++ b/pkg/types/alertmanagertypes/channel.go
@@ -150,24 +150,6 @@ func NewConfigFromChannels(globalConfig GlobalConfig, routeConfig RouteConfig, c
 	return cfg, nil
 }

-func MapChannelNamesToIDs(channels Channels, names []string) ([]string, error) {
-	idByName := make(map[string]string, len(channels))
-	for _, channel := range channels {
-		idByName[channel.DisplayName] = channel.ID.StringValue()
-	}
-
-	ids := make([]string, 0, len(names))
-	for _, name := range names {
-		id, ok := idByName[name]
-		if !ok {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "notification channel %q does not exist", name)
-		}
-		ids = append(ids, id)
-	}
-
-	return ids, nil
-}
-
 func NewStatsFromChannels(channels Channels) map[string]any {
 	stats := make(map[string]any)
 	for _, channel := range channels {
--- a/pkg/types/alertmanagertypes/channel_test.go
+++ b/pkg/types/alertmanagertypes/channel_test.go
@@ -6,12 +6,9 @@ import (
 	"testing"
 	"time"

-	"github.com/SigNoz/signoz/pkg/types"
-	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/prometheus/alertmanager/config"
 	"github.com/prometheus/common/model"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestNewConfigFromChannels(t *testing.T) {
@@ -299,36 +296,3 @@ func TestNewChannelFromReceiverGoogleChat(t *testing.T) {
 		channel.Data,
 	)
 }
-
-func TestMapChannelNamesToIDs(t *testing.T) {
-	slackID := valuer.GenerateUUID()
-	pagerID := valuer.GenerateUUID()
-	channels := Channels{
-		{Identifiable: types.Identifiable{ID: slackID}, DisplayName: "slack"},
-		{Identifiable: types.Identifiable{ID: pagerID}, DisplayName: "pager"},
-	}
-
-	testCases := []struct {
-		name    string
-		names   []string
-		want    []string
-		wantErr bool
-	}{
-		{name: "AllKnown_IDsInRequestOrder", names: []string{"pager", "slack"}, want: []string{pagerID.StringValue(), slackID.StringValue()}},
-		{name: "UnknownName_Errors", names: []string{"slack", "missing"}, wantErr: true},
-		{name: "NoNames_Empty", names: nil, want: []string{}},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			got, err := MapChannelNamesToIDs(channels, testCase.names)
-			if testCase.wantErr {
-				require.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, testCase.want, got)
-		})
-	}
-}
--- a/pkg/types/coretypes/kind.go
+++ b/pkg/types/coretypes/kind.go
@@ -80,6 +80,7 @@ func (name Kind) Enum() []any {
 		KindLogsField,
 		KindTracesField,
 		KindMetricsField,
+		KindLLMPricingRule,
 	}
 }

--- a/pkg/types/coretypes/registry_kind.go
+++ b/pkg/types/coretypes/registry_kind.go
@@ -40,6 +40,7 @@ var Kinds = []Kind{
 	KindLogsField,
 	KindTracesField,
 	KindMetricsField,
+	KindLLMPricingRule,
 }

 var (
@@ -82,4 +83,5 @@ var (
 	KindLogsField                    = MustNewKind("logs-field")
 	KindTracesField                  = MustNewKind("traces-field")
 	KindMetricsField                 = MustNewKind("metrics-field")
+	KindLLMPricingRule               = MustNewKind("llm-pricing-rule")
 )
--- a/pkg/types/coretypes/registry_managed_role.go
+++ b/pkg/types/coretypes/registry_managed_role.go
@@ -134,16 +134,12 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		// rule — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		// saved-view — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
@@ -176,16 +172,12 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		// route-policy — admin writes, viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		// apdex-setting — admin updates, viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindApdexSetting}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindApdexSetting}, WildCardSelectorString)},
@@ -226,6 +218,11 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — admin writes, viewer reads
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
 	},
 	SigNozEditorRoleName: {
 		// cloud-integration — editor can read accounts
@@ -249,16 +246,12 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		// rule — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		// saved-view — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
@@ -294,8 +287,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// notification-channel — read only (admin writes)
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		// route-policy — read only (admin writes)
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
@@ -331,6 +322,9 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — read only (admin writes)
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
 	},
 	SigNozViewerRoleName: {
 		// cloud-integration — viewer can read accounts
@@ -395,6 +389,9 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// metrics-field — viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — read only
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
 	},
 	SigNozAnonymousRoleName: {
 		// public-dashboard — anonymous read
--- a/pkg/types/coretypes/registry_resource.go
+++ b/pkg/types/coretypes/registry_resource.go
@@ -40,6 +40,7 @@ var Resources = []Resource{
 	ResourceMetaResourceLogsField,
 	ResourceMetaResourceTracesField,
 	ResourceMetaResourceMetricsField,
+	ResourceMetaResourceLLMPricingRule,
 }

 var (
@@ -48,7 +49,7 @@ var (
 	ResourceRole                                         = NewResourceRole()
 	ResourceServiceAccount                               = NewResourceServiceAccount()
 	ResourceUser                                         = NewResourceUser()
-	ResourceMetaResourceNotificationChannel              = NewResourceMetaResource(KindNotificationChannel)
+	ResourceMetaResourceNotificationChannel              = NewResourceMetaResource(KindNotificationChannel, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourceRoutePolicy                      = NewResourceMetaResource(KindRoutePolicy)
 	ResourceMetaResourceApdexSetting                     = NewResourceMetaResource(KindApdexSetting)
 	ResourceMetaResourceAuthDomain                       = NewResourceMetaResource(KindAuthDomain)
@@ -82,4 +83,5 @@ var (
 	ResourceMetaResourceLogsField                        = NewResourceMetaResource(KindLogsField)
 	ResourceMetaResourceTracesField                      = NewResourceMetaResource(KindTracesField)
 	ResourceMetaResourceMetricsField                     = NewResourceMetaResource(KindMetricsField, VerbList, VerbRead, VerbUpdate)
+	ResourceMetaResourceLLMPricingRule                   = NewResourceMetaResource(KindLLMPricingRule, VerbList, VerbRead, VerbUpdate, VerbDelete)
 )
--- a/pkg/types/llmpricingruletypes/resource.go
+++ b/pkg/types/llmpricingruletypes/resource.go
@@ -0,0 +1,62 @@
+package llmpricingruletypes
+
+import (
+	"context"
+	"slices"
+
+	"github.com/tidwall/gjson"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+// UpdatableRulesResources resolves the pricing rules an upsert body writes to.
+//
+// A rule with isOverride and an id is an edit, checked by that id. Everything
+// else resolves to the wildcard: isOverride without an id is a create, sourceId
+// without isOverride is a sync row, and an empty list has nothing to check.
+func UpdatableRulesResources(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
+	rules := gjson.GetBytes(ec.RequestBody, "rules").Array()
+
+	ids := make([]string, 0, len(rules))
+	wildcard := len(rules) == 0
+	for _, rule := range rules {
+		rawID := rule.Get("id").String()
+		isOverride := rule.Get("isOverride").Type
+		if rawID == "" || (isOverride != gjson.True && isOverride != gjson.False) {
+			wildcard = true
+			continue
+		}
+
+		// Normalised through valuer so an uppercase id still matches the
+		// lowercase selector regex of the metaresource type.
+		id, err := valuer.NewUUID(rawID)
+		if err != nil {
+			return nil, errors.Wrapf(err, errors.TypeInvalidInput, ErrCodePricingRuleInvalidInput, "rule id %q is not a valid uuid", rawID)
+		}
+		if !slices.Contains(ids, id.StringValue()) {
+			ids = append(ids, id.StringValue())
+		}
+	}
+	if wildcard {
+		ids = append(ids, coretypes.WildCardSelectorString)
+	}
+
+	resources := make([]coretypes.ResourceWithID, 0, len(ids))
+	for _, id := range ids {
+		resources = append(resources, coretypes.ResourceWithID{Resource: coretypes.ResourceMetaResourceLLMPricingRule, ID: id})
+	}
+
+	return resources, nil
+}
+
+// RuleSelector exists because IDSelector would turn the wildcard entry into
+// the wildcard twice; an id still resolves to the id plus the wildcard.
+func RuleSelector(ctx context.Context, resource coretypes.Resource, id string, orgID valuer.UUID) ([]coretypes.Selector, error) {
+	if id == coretypes.WildCardSelectorString {
+		return coretypes.WildcardSelector(ctx, resource, id, orgID)
+	}
+
+	return coretypes.IDSelector(ctx, resource, id, orgID)
+}
--- a/pkg/types/llmpricingruletypes/resource_test.go
+++ b/pkg/types/llmpricingruletypes/resource_test.go
@@ -0,0 +1,106 @@
+package llmpricingruletypes
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+func TestUpdatableRulesResources(t *testing.T) {
+	testCases := []struct {
+		name    string
+		body    string
+		want    []string
+		wantErr bool
+	}{
+		{
+			name: "EmptyRules_Wildcard",
+			body: `{"rules":[]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "Edit_ID",
+			body: `{"rules":[{"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}]}`,
+			want: []string{"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e"},
+		},
+		{
+			name: "Create_Wildcard",
+			body: `{"rules":[{"modelName":"gpt","isOverride":true}]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "SyncRow_Wildcard",
+			body: `{"rules":[{"sourceId":"4e9a0b12-3c4d-4e5f-8a6b-7c8d9e0f1a2b"}]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "Mixed_DedupedIDsThenWildcardOnce",
+			body: `{"rules":[{"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true},{"modelName":"new","isOverride":true},{"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":false},{"sourceId":"7bcd3e45-6f7a-4b8c-9d9e-0f1a2b3c4d5e"}]}`,
+			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d", "*"},
+		},
+		{
+			name: "UppercaseID_Lowercased",
+			body: `{"rules":[{"id":"8CDE4F56-7A8B-4C9D-8E0F-1A2B3C4D5E6F","isOverride":true}]}`,
+			want: []string{"8cde4f56-7a8b-4c9d-8e0f-1a2b3c4d5e6f"},
+		},
+		{
+			name:    "InvalidID_Rejected",
+			body:    `{"rules":[{"id":"not-a-uuid","isOverride":true}]}`,
+			wantErr: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			resources, err := UpdatableRulesResources(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
+			if testCase.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			got := make([]string, 0, len(resources))
+			for _, resource := range resources {
+				got = append(got, resource.ID)
+			}
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}
+
+func TestRuleSelector(t *testing.T) {
+	testCases := []struct {
+		name string
+		id   string
+		want []string
+	}{
+		{
+			name: "Wildcard_WildcardOnly",
+			id:   "*",
+			want: []string{"*"},
+		},
+		{
+			name: "ID_IDThenWildcard",
+			id:   "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+			want: []string{"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "*"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			selectors, err := RuleSelector(context.Background(), coretypes.ResourceMetaResourceLLMPricingRule, testCase.id, valuer.GenerateUUID())
+			require.NoError(t, err)
+
+			got := make([]string, 0, len(selectors))
+			for _, selector := range selectors {
+				got = append(got, selector.String())
+			}
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}
--- a/pkg/types/ruletypes/api_params.go
+++ b/pkg/types/ruletypes/api_params.go
@@ -337,19 +337,6 @@ func (r *PostableRule) UnmarshalJSON(bytes []byte) error {
 	return r.validate()
 }

-func NewPatchedPostableRule(stored, patch []byte) (*PostableRule, error) {
-	patched := new(PostableRule)
-	if err := json.Unmarshal(stored, patched); err != nil {
-		return nil, err
-	}
-
-	if err := json.Unmarshal(patch, patched); err != nil {
-		return nil, err
-	}
-
-	return patched, nil
-}
-
 func isValidLabelName(ln string) bool {
 	if len(ln) == 0 {
 		return false
--- a/tests/integration/testdata/role/managed_role_transactions.json
+++ b/tests/integration/testdata/role/managed_role_transactions.json
@@ -188,9 +188,7 @@
        "read",
        "update",
        "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
      ]
    },
    {
@@ -201,9 +199,7 @@
        "read",
        "update",
        "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
      ]
    },
    {
@@ -260,9 +256,7 @@
        "read",
        "update",
        "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
      ]
    },
    {
@@ -273,9 +267,7 @@
        "read",
        "update",
        "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
      ]
    },
    {
@@ -305,6 +297,16 @@
        "list"
      ]
    },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "update",
+        "delete",
+        "list"
+      ]
+    },
    {
      "type": "metaresource",
      "kind": "ttl-setting",
@@ -424,9 +426,7 @@
        "read",
        "update",
        "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
      ]
    },
    {
@@ -437,9 +437,7 @@
        "read",
        "update",
        "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
      ]
    },
    {
@@ -504,9 +502,7 @@
      "kind": "notification-channel",
      "verbs": [
        "read",
-        "list",
-        "attach",
-        "detach"
+        "list"
      ]
    },
    {
@@ -542,6 +538,14 @@
        "list"
      ]
    },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "list"
+      ]
+    },
    {
      "type": "metaresource",
      "kind": "ttl-setting",
@@ -721,6 +725,14 @@
        "list"
      ]
    },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "list"
+      ]
+    },
    {
      "type": "metaresource",
      "kind": "ttl-setting",
--- a/tests/integration/tests/llmpricingrules/02_authz.py
+++ b/tests/integration/tests/llmpricingrules/02_authz.py
@@ -0,0 +1,267 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import pytest
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures import types
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    add_license,
+    change_user_role,
+    create_active_user,
+)
+from fixtures.llmpricingrules import (
+    LLM_PRICING_RULES_URL,
+    delete_all_llm_pricing_rules,
+    list_llm_pricing_rules,
+    upsert_llm_pricing_rules,
+)
+from fixtures.role import find_role_by_name, transaction_group
+
+user_password = "password123Z$"
+editor_email = "llm-pricing-editor@integration.test"
+viewer_email = "llm-pricing-viewer@integration.test"
+updater_role = "llm-pricing-updater"
+updater_email = "llm-pricing-updater@integration.test"
+scoped_role = "llm-pricing-scoped"
+scoped_email = "llm-pricing-scoped@integration.test"
+
+PROBE_RULE = {
+    "modelName": "authz-probe",
+    "provider": "OpenAI",
+    "modelPattern": ["authz-probe*"],
+    "unit": "per_million_tokens",
+    "pricing": {"input": 1, "output": 2},
+    "isOverride": True,
+    "enabled": True,
+}
+
+OTHER_RULE = {
+    "modelName": "authz-probe-other",
+    "provider": "Anthropic",
+    "modelPattern": ["authz-probe-other*"],
+    "unit": "per_million_tokens",
+    "pricing": {"input": 3, "output": 4},
+    "isOverride": True,
+    "enabled": True,
+}
+
+
+def test_setup(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+) -> None:
+    add_license(signoz, make_http_mocks, get_token)
+
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    delete_all_llm_pricing_rules(signoz, admin_token)
+    assert upsert_llm_pricing_rules(signoz, admin_token, [PROBE_RULE, OTHER_RULE]).status_code == HTTPStatus.NO_CONTENT
+    probe_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+
+    create_active_user(signoz, admin_token, email=editor_email, role="signoz-editor", password=user_password)
+    create_active_user(signoz, admin_token, email=viewer_email, role="signoz-viewer", password=user_password)
+
+    create_role(admin_token, updater_role, [transaction_group("update", "metaresource", "llm-pricing-rule", ["*"])])
+    updater = create_active_user(signoz, admin_token, email=updater_email, role="signoz-viewer", password=user_password)
+    change_user_role(signoz, admin_token, updater, "signoz-viewer", updater_role)
+
+    create_role(
+        admin_token,
+        scoped_role,
+        [
+            transaction_group("read", "metaresource", "llm-pricing-rule", [probe_id]),
+            transaction_group("update", "metaresource", "llm-pricing-rule", [probe_id]),
+            transaction_group("delete", "metaresource", "llm-pricing-rule", [probe_id]),
+        ],
+    )
+    scoped = create_active_user(signoz, admin_token, email=scoped_email, role="signoz-viewer", password=user_password)
+    change_user_role(signoz, admin_token, scoped, "signoz-viewer", scoped_role)
+
+
+@pytest.mark.parametrize(
+    "path",
+    [LLM_PRICING_RULES_URL, f"{LLM_PRICING_RULES_URL}/unmapped_models"],
+    ids=["list", "unmapped_models"],
+)
+@pytest.mark.parametrize(
+    ("email", "expected"),
+    [
+        (USER_ADMIN_EMAIL, HTTPStatus.OK),
+        (editor_email, HTTPStatus.OK),
+        (viewer_email, HTTPStatus.OK),
+        (updater_email, HTTPStatus.FORBIDDEN),
+        (scoped_email, HTTPStatus.FORBIDDEN),
+    ],
+    ids=["admin", "editor", "viewer", "updater", "scoped"],
+)
+def test_reads_need_list_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    path: str,
+    email: str,
+    expected: HTTPStatus,
+) -> None:
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(path),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:list" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "model_name", "expected"),
+    [
+        (USER_ADMIN_EMAIL, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (editor_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (viewer_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
+    ],
+    ids=["admin", "editor", "viewer", "updater", "scoped_granted", "scoped_other"],
+)
+def test_get_needs_read_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    model_name: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:read" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "expected"),
+    [
+        (editor_email, HTTPStatus.FORBIDDEN),
+        (viewer_email, HTTPStatus.FORBIDDEN),
+        (scoped_email, HTTPStatus.NO_CONTENT),
+        (updater_email, HTTPStatus.NO_CONTENT),
+        (USER_ADMIN_EMAIL, HTTPStatus.NO_CONTENT),
+    ],
+    ids=["editor", "viewer", "scoped", "updater", "admin"],
+)
+def test_upsert_needs_update_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = upsert_llm_pricing_rules(signoz, token, [{**PROBE_RULE, "id": rule_id}])
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:update" in response.text
+
+
+@pytest.mark.parametrize(
+    "shape",
+    ["other_rule", "create", "sync_row", "own_and_other"],
+    ids=["other_rule", "create", "sync_row", "own_and_other"],
+)
+def test_upsert_scoped_to_granted_rule(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    shape: str,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rules = {r["modelName"]: r for r in list_llm_pricing_rules(signoz, admin_token)}
+    own = {**PROBE_RULE, "id": rules[PROBE_RULE["modelName"]]["id"]}
+    other = {**OTHER_RULE, "id": rules[OTHER_RULE["modelName"]]["id"]}
+    sync_row = {**{k: v for k, v in PROBE_RULE.items() if k != "isOverride"}, "sourceId": "11111111-1111-4111-8111-111111111199"}
+    bodies = {"other_rule": [other], "create": [PROBE_RULE], "sync_row": [sync_row], "own_and_other": [own, other]}
+
+    response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), bodies[shape])
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+    assert "llm-pricing-rule:update" in response.text
+
+
+def test_revoke_update_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, scoped_role)}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "llm-pricing-rule", [rule_id]),
+                transaction_group("delete", "metaresource", "llm-pricing-rule", [rule_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=10,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), [{**PROBE_RULE, "id": rule_id}])
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+    assert "llm-pricing-rule:update" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "model_name", "expected"),
+    [
+        (editor_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (viewer_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, PROBE_RULE["modelName"], HTTPStatus.NO_CONTENT),
+        (USER_ADMIN_EMAIL, OTHER_RULE["modelName"], HTTPStatus.NO_CONTENT),
+    ],
+    ids=["editor", "viewer", "updater", "scoped_other", "scoped_granted", "admin"],
+)
+def test_delete_needs_delete_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    model_name: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:delete" in response.text
+
+
+def test_cleanup(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    delete_all_llm_pricing_rules(signoz, get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD))
--- a/tests/integration/tests/ruler/08_authz.py
+++ b/tests/integration/tests/ruler/08_authz.py
Author	SHA1	Message	Date
nityanandagohain	3c263501b4	fix: update integration test	2026-10-26 16:52:56 +05:30
nityanandagohain	d04c0a2366	feat(authz): enable FGA for llm pricing rule routes	2026-10-26 15:57:28 +05:30