fix: address comment

docs/api/openapi.yml

@@ -3932,6 +3932,7 @@ components:
       - logs-field
       - traces-field
       - metrics-field
+      - llm-pricing-rule
       type: string
     CoretypesObject:
       properties:
@@ -15759,9 +15760,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - llm-pricing-rule:list
       - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:list
       summary: List pricing rules
       tags:
       - llmpricingrules
@@ -15806,9 +15807,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - llm-pricing-rule:update
       - tokenizer:
-        - ADMIN
+        - llm-pricing-rule:update
       summary: Create or update pricing rules
       tags:
       - llmpricingrules
@@ -15854,9 +15855,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - llm-pricing-rule:delete
       - tokenizer:
-        - ADMIN
+        - llm-pricing-rule:delete
       summary: Delete a pricing rule
       tags:
       - llmpricingrules
@@ -15912,9 +15913,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - llm-pricing-rule:read
       - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:read
       summary: Get a pricing rule
       tags:
       - llmpricingrules
@@ -15967,9 +15968,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - llm-pricing-rule:list
       - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:list
       summary: List unmapped models
       tags:
       - llmpricingrules

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -3579,6 +3579,7 @@ export enum CoretypesKindDTO {
 	'logs-field' = 'logs-field',
 	'traces-field' = 'traces-field',
 	'metrics-field' = 'metrics-field',
+	'llm-pricing-rule' = 'llm-pricing-rule',
 }
 export enum CoretypesTypeDTO {
 	user = 'user',

frontend/src/components/QueryBuilderV2/QueryV2/MerticsAggregateSection/MetricsAggregateSection.tsx

@@ -129,7 +129,6 @@ const MetricsAggregateSection = memo(function MetricsAggregateSection({
 										onChange={handleChangeOperator}
 										operators={operators}
 										className="metrics-operators-select"
-										data-testid="metrics-time-aggregation"
 									/>
 								</div>
 							</div>
@@ -193,10 +192,7 @@ const MetricsAggregateSection = memo(function MetricsAggregateSection({
 										AGGREGATE ACROSS TIME SERIES
 									</div>
 								</Tooltip>
-								<div
-									className="metrics-aggregation-section-content-item-value"
-									data-testid="metrics-space-aggregation"
-								>
+								<div className="metrics-aggregation-section-content-item-value">
 									<SpaceAggregationOptions
 										panelType={panelType}
 										key={`${panelType}${queryAggregation.spaceAggregation}${queryAggregation.timeAggregation}`}
@@ -233,10 +229,7 @@ const MetricsAggregateSection = memo(function MetricsAggregateSection({
 				<div className="metrics-space-aggregation-section">
 					<div className="metrics-aggregation-section-content">
 						<div className="metrics-aggregation-section-content-item">
-							<div
-								className="metrics-aggregation-section-content-item-value"
-								data-testid="metrics-space-aggregation"
-							>
+							<div className="metrics-aggregation-section-content-item-value">
 								<SpaceAggregationOptions
 									panelType={panelType}
 									key={`${panelType}${queryAggregation.spaceAggregation}${queryAggregation.timeAggregation}`}

frontend/src/components/QueryBuilderV2/QueryV2/QueryAddOns/HavingFilter/HavingFilter.tsx

@@ -332,7 +332,6 @@ function HavingFilter({
 					value={input}
 					onChange={handleChange}
 					theme={isDarkMode ? copilot : githubLight}
-					data-testid="having-editor"
 					className="having-filter-select-editor"
 					width="100%"
 					extensions={[

frontend/src/components/QueryBuilderV2/QueryV2/QueryAggregation/QueryAggregationSelect.tsx

@@ -615,7 +615,6 @@ function QueryAggregationSelect({
 					setInput(value);
 					onChange?.(value);
 				}}
-				data-testid="query-aggregation-editor"
 				className={`query-aggregation-select-editor ${
 					validationError ? 'error' : ''
 				}`}

frontend/src/components/QueryBuilderV2/QueryV2/QuerySearch/QuerySearch.tsx

@@ -1607,7 +1607,6 @@ function QuerySearch({
 					onChange={handleChange}
 					onUpdate={handleUpdate}
 					onCreateEditor={handleEditorCreate}
-					data-testid="query-where-clause-editor"
 					className={cx('query-where-clause-editor', {
 						isValid: validation.isValid === true,
 						hasErrors: validation.errors.length > 0,
@@ -1681,7 +1680,6 @@ function QuerySearch({
 						className={cx('query-status-container', {
 							hasErrors: validation.errors.length > 0,
 						})}
-						data-testid="query-validation-status"
 					>
 						<Popover
 							placement="bottomRight"

frontend/src/components/QueryBuilderV2/QueryV2/QueryV2.tsx

@@ -183,7 +183,6 @@ export const QueryV2 = forwardRef(function QueryV2(
 		<div
 			className={cx('query-v2', { 'where-clause-view': showOnlyWhereClause })}
 			ref={ref}
-			data-testid={`query-${query.queryName}`}
 		>
 			<div className="qb-content-section">
 				{(!showOnlyWhereClause || showTraceOperator) && (
@@ -247,7 +246,6 @@ export const QueryV2 = forwardRef(function QueryV2(
 							{isMultiQueryAllowed && (
 								<Dropdown
 									items={queryActionItems}
-									testId="query-actions"
 									nativeButton={false}
 									align="end"
 									side="bottom"

frontend/src/components/QueryBuilderV2/QueryV2/TraceOperator/TraceOperator.tsx

@@ -61,10 +61,7 @@ export default function TraceOperator({
 	);
 
 	return (
-		<div
-			className={cx('qb-trace-operator', !isRawQuery && 'non-list-view')}
-			data-testid="trace-operator"
-		>
+		<div className={cx('qb-trace-operator', !isRawQuery && 'non-list-view')}>
 			<div className="qb-trace-operator-container">
 				<div
 					className={cx(

frontend/src/components/QueryBuilderV2/QueryV2/TraceOperator/TraceOperatorEditor.tsx

@@ -378,7 +378,6 @@ function TraceOperatorEditor({
 					theme={isDarkMode ? copilot : githubLight}
 					onChange={handleChange}
 					onUpdate={handleUpdate}
-					data-testid="trace-operator-editor"
 					className={cx('query-where-clause-editor', {
 						isValid: validation.isValid === true,
 						hasErrors: validation.errors.length > 0,

frontend/src/container/QueryBuilder/components/Formula/Formula.tsx

@@ -112,7 +112,7 @@ export function Formula({
 	);
 
 	return (
-		<Row gutter={[0, 15]} data-testid={`formula-${formula.queryName}`}>
+		<Row gutter={[0, 15]}>
 			<QBEntityOptions
 				isCollapsed={isCollapse}
 				showFunctions={false}
@@ -130,7 +130,6 @@ export function Formula({
 						<Input.TextArea
 							name="expression"
 							className="formula-expression"
-							data-testid="formula-expression"
 							onChange={handleChange}
 							size="middle"
 							value={formula.expression}
@@ -142,7 +141,6 @@ export function Formula({
 						<Input
 							name="legend"
 							className="formula-legend"
-							data-testid="formula-legend"
 							onChange={handleChange}
 							size="middle"
 							value={formula.legend}

frontend/src/container/QueryBuilder/components/QBEntityOptions/QBEntityOptions.tsx

@@ -98,7 +98,6 @@ export default function QBEntityOptions({
 									value="search"
 									className="periscope-btn collapse"
 									onClick={onCollapseEntity}
-									data-testid="qb-entity-collapse"
 								>
 									{isCollapsed ? <ChevronRight size={16} /> : <ChevronDown size={16} />}
 								</Button>
@@ -109,7 +108,6 @@ export default function QBEntityOptions({
 									className="periscope-btn visibility-toggle"
 									onClick={onToggleVisibility}
 									disabled={isRawQuery && !showTraceOperator}
-									data-testid="qb-entity-visibility"
 								>
 									{entityData.disabled ? <EyeOff size={16} /> : <Eye size={16} />}
 								</Button>
@@ -117,11 +115,7 @@ export default function QBEntityOptions({
 
 							{entityType === 'query' && showCloneOption && (
 								<Tooltip title={`Clone Query ${entityData.queryName}`}>
-									<Button
-										className={cx('periscope-btn')}
-										onClick={handleCloneEntity}
-										data-testid="qb-entity-clone"
-									>
+									<Button className={cx('periscope-btn')} onClick={handleCloneEntity}>
 										<Copy size={14} />
 									</Button>
 								</Tooltip>
@@ -137,7 +131,6 @@ export default function QBEntityOptions({
 										: '',
 									isLogsExplorerPage && lastUsedQuery === index ? 'sync-btn' : '',
 								)}
-								data-testid="qb-entity-name"
 							>
 								{entityData.queryName}
 							</Button>
@@ -192,11 +185,7 @@ export default function QBEntityOptions({
 				</div>
 
 				{showDeleteButton && !isRawQuery && (
-					<Button
-						className="periscope-btn ghost"
-						onClick={onDelete}
-						data-testid="qb-entity-delete"
-					>
+					<Button className="periscope-btn ghost" onClick={onDelete}>
 						<Trash2 size={14} />
 					</Button>
 				)}

frontend/src/pages/DashboardPage/DashboardContainer/PanelEditor/PanelEditorQueryBuilder/PanelEditorQueryBuilder.tsx

@@ -166,10 +166,7 @@ function PanelEditorQueryBuilder({
 		return modes.map((queryType) => ({
 			key: queryType,
 			label: (
-				<div
-					className={styles.queryTypeTab}
-					data-testid={`query-type-tab-${queryType}`}
-				>
+				<div className={styles.queryTypeTab}>
 					{queryTypeComponents[queryType].icon}
 					<Typography>{queryTypeComponents[queryType].label}</Typography>
 				</div>

frontend/src/schemas/generated/transactionGroups.schema.json

@@ -74,7 +74,8 @@
         "meter-metrics",
         "logs-field",
         "traces-field",
-        "metrics-field"
+        "metrics-field",
+        "llm-pricing-rule"
       ],
       "type": "string"
     },

pkg/apiserver/signozapiserver/llmpricingrule.go

@@ -4,14 +4,15 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/llmpricingruletypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 	if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.List),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.List, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListLLMPricingRules",
 			Tags:                []string{"llmpricingrules"},
@@ -25,14 +26,20 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.CreateOrUpdate),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.CreateOrUpdate, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                 "CreateOrUpdateLLMPricingRules",
 			Tags:               []string{"llmpricingrules"},
@@ -43,14 +50,20 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:  http.StatusNoContent,
 			ErrorStatusCodes:   []int{http.StatusBadRequest},
 			Deprecated:         false,
-			SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbUpdate)}),
 		},
+		handler.WithResourceDefs(handler.TelemetryResourceDef{
+			Verb:      coretypes.VerbUpdate,
+			Category:  coretypes.ActionCategoryConfigurationChange,
+			Selector:  llmpricingruletypes.RuleSelector,
+			Resources: llmpricingruletypes.UpdatableRulesResources,
+		}),
 	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/unmapped_models", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.ListUnmappedModels),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.ListUnmappedModels, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListUnmappedLLMModels",
 			Tags:                []string{"llmpricingrules"},
@@ -63,14 +76,20 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.Get),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Get, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetLLMPricingRule",
 			Tags:                []string{"llmpricingrules"},
@@ -83,14 +102,21 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.Delete),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Delete, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "DeleteLLMPricingRule",
 			Tags:                []string{"llmpricingrules"},
@@ -103,8 +129,15 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbDelete)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

pkg/signoz/provider.go

@@ -266,6 +266,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddMetricsFieldTuplesFactory(sqlstore),
 		sqlmigration.NewAddGCPConnectionMethodFactory(),
 		sqlmigration.NewDeleteOrphanSARolesFactory(),
+		sqlmigration.NewAddLLMPricingRuleTuplesFactory(sqlstore),
 	)
 }
 

pkg/sqlmigration/140_add_llm_pricing_rule_tuples.go

@@ -0,0 +1,162 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addLLMPricingRuleTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddLLMPricingRuleTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_llm_pricing_rule_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addLLMPricingRuleTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addLLMPricingRuleTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addLLMPricingRuleTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "list"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "list"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
+	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
+		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
+		if err != nil {
+			return err
+		}
+		managedRoleGroups[roleName] = string(data)
+	}
+
+	for _, orgID := range orgIDs {
+		for roleName, data := range managedRoleGroups {
+			if _, err := tx.NewUpdate().
+				Model(new(roles)).
+				Set("transaction_groups = ?", data).
+				Where("org_id = ?", orgID).
+				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
+				Where("name = ?", roleName).
+				Exec(ctx); err != nil {
+				return err
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addLLMPricingRuleTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/types/coretypes/kind.go

@@ -80,6 +80,7 @@ func (name Kind) Enum() []any {
 		KindLogsField,
 		KindTracesField,
 		KindMetricsField,
+		KindLLMPricingRule,
 	}
 }
 

pkg/types/coretypes/registry_kind.go

@@ -40,6 +40,7 @@ var Kinds = []Kind{
 	KindLogsField,
 	KindTracesField,
 	KindMetricsField,
+	KindLLMPricingRule,
 }
 
 var (
@@ -82,4 +83,5 @@ var (
 	KindLogsField                    = MustNewKind("logs-field")
 	KindTracesField                  = MustNewKind("traces-field")
 	KindMetricsField                 = MustNewKind("metrics-field")
+	KindLLMPricingRule               = MustNewKind("llm-pricing-rule")
 )

pkg/types/coretypes/registry_managed_role.go

@@ -218,6 +218,11 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — admin writes, viewer reads
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
 	},
 	SigNozEditorRoleName: {
 		// cloud-integration — editor can read accounts
@@ -317,6 +322,9 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — read only (admin writes)
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
 	},
 	SigNozViewerRoleName: {
 		// cloud-integration — viewer can read accounts
@@ -381,6 +389,9 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// metrics-field — viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — read only
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
 	},
 	SigNozAnonymousRoleName: {
 		// public-dashboard — anonymous read

pkg/types/coretypes/registry_resource.go

@@ -40,6 +40,7 @@ var Resources = []Resource{
 	ResourceMetaResourceLogsField,
 	ResourceMetaResourceTracesField,
 	ResourceMetaResourceMetricsField,
+	ResourceMetaResourceLLMPricingRule,
 }
 
 var (
@@ -82,4 +83,5 @@ var (
 	ResourceMetaResourceLogsField                        = NewResourceMetaResource(KindLogsField)
 	ResourceMetaResourceTracesField                      = NewResourceMetaResource(KindTracesField)
 	ResourceMetaResourceMetricsField                     = NewResourceMetaResource(KindMetricsField, VerbList, VerbRead, VerbUpdate)
+	ResourceMetaResourceLLMPricingRule                   = NewResourceMetaResource(KindLLMPricingRule, VerbList, VerbRead, VerbUpdate, VerbDelete)
 )

pkg/types/llmpricingruletypes/resource.go

@@ -0,0 +1,65 @@
+package llmpricingruletypes
+
+import (
+	"context"
+	"encoding/json"
+	"slices"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+// UpdatableRulesResources resolves the pricing rules an upsert body writes to.
+//
+// A rule with isOverride and an id is an edit, checked by that id. Everything
+// else resolves to the wildcard: isOverride without an id is a create, sourceId
+// without isOverride is a sync row, and an empty list has nothing to check.
+func UpdatableRulesResources(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
+	// encoding/json with the handler's tags, so duplicate or case-variant id
+	// keys resolve to the id that is actually written.
+	var body struct {
+		Rules []*struct {
+			// Normalised through valuer so an uppercase id still matches the
+			// lowercase selector regex of the metaresource type.
+			ID         *valuer.UUID `json:"id"`
+			IsOverride *bool        `json:"isOverride"`
+		} `json:"rules"`
+	}
+	if err := json.Unmarshal(ec.RequestBody, &body); err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInvalidInput, ErrCodePricingRuleInvalidInput, "invalid pricing rules body")
+	}
+
+	ids := make([]string, 0, len(body.Rules))
+	wildcard := len(body.Rules) == 0
+	for _, rule := range body.Rules {
+		if rule == nil || rule.ID == nil || rule.IsOverride == nil {
+			wildcard = true
+			continue
+		}
+
+		if !slices.Contains(ids, rule.ID.StringValue()) {
+			ids = append(ids, rule.ID.StringValue())
+		}
+	}
+	if wildcard {
+		ids = append(ids, coretypes.WildCardSelectorString)
+	}
+
+	resources := make([]coretypes.ResourceWithID, 0, len(ids))
+	for _, id := range ids {
+		resources = append(resources, coretypes.ResourceWithID{Resource: coretypes.ResourceMetaResourceLLMPricingRule, ID: id})
+	}
+
+	return resources, nil
+}
+
+// RuleSelector exists because IDSelector would turn the wildcard entry into
+// the wildcard twice; an id still resolves to the id plus the wildcard.
+func RuleSelector(ctx context.Context, resource coretypes.Resource, id string, orgID valuer.UUID) ([]coretypes.Selector, error) {
+	if id == coretypes.WildCardSelectorString {
+		return coretypes.WildcardSelector(ctx, resource, id, orgID)
+	}
+
+	return coretypes.IDSelector(ctx, resource, id, orgID)
+}

pkg/types/llmpricingruletypes/resource_test.go

@@ -0,0 +1,116 @@
+package llmpricingruletypes
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+func TestUpdatableRulesResources(t *testing.T) {
+	testCases := []struct {
+		name    string
+		body    string
+		want    []string
+		wantErr bool
+	}{
+		{
+			name: "EmptyRules_Wildcard",
+			body: `{"rules":[]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "Edit_ID",
+			body: `{"rules":[{"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}]}`,
+			want: []string{"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e"},
+		},
+		{
+			name: "Create_Wildcard",
+			body: `{"rules":[{"modelName":"gpt","isOverride":true}]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "SyncRow_Wildcard",
+			body: `{"rules":[{"sourceId":"4e9a0b12-3c4d-4e5f-8a6b-7c8d9e0f1a2b"}]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "Mixed_DedupedIDsThenWildcardOnce",
+			body: `{"rules":[{"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true},{"modelName":"new","isOverride":true},{"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":false},{"sourceId":"7bcd3e45-6f7a-4b8c-9d9e-0f1a2b3c4d5e"}]}`,
+			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d", "*"},
+		},
+		{
+			name: "UppercaseID_Lowercased",
+			body: `{"rules":[{"id":"8CDE4F56-7A8B-4C9D-8E0F-1A2B3C4D5E6F","isOverride":true}]}`,
+			want: []string{"8cde4f56-7a8b-4c9d-8e0f-1a2b3c4d5e6f"},
+		},
+		{
+			name: "DuplicateIDKey_LastWins",
+			body: `{"rules":[{"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true}]}`,
+			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d"},
+		},
+		{
+			name: "CaseVariantIDKey_LastWins",
+			body: `{"rules":[{"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","ID":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true}]}`,
+			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d"},
+		},
+		{
+			name:    "InvalidID_Rejected",
+			body:    `{"rules":[{"id":"not-a-uuid","isOverride":true}]}`,
+			wantErr: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			resources, err := UpdatableRulesResources(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
+			if testCase.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			got := make([]string, 0, len(resources))
+			for _, resource := range resources {
+				got = append(got, resource.ID)
+			}
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}
+
+func TestRuleSelector(t *testing.T) {
+	testCases := []struct {
+		name string
+		id   string
+		want []string
+	}{
+		{
+			name: "Wildcard_WildcardOnly",
+			id:   "*",
+			want: []string{"*"},
+		},
+		{
+			name: "ID_IDThenWildcard",
+			id:   "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+			want: []string{"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "*"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			selectors, err := RuleSelector(context.Background(), coretypes.ResourceMetaResourceLLMPricingRule, testCase.id, valuer.GenerateUUID())
+			require.NoError(t, err)
+
+			got := make([]string, 0, len(selectors))
+			for _, selector := range selectors {
+				got = append(got, selector.String())
+			}
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}

tests/integration/testdata/role/managed_role_transactions.json

@@ -297,6 +297,16 @@
         "list"
       ]
     },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "update",
+        "delete",
+        "list"
+      ]
+    },
     {
       "type": "metaresource",
       "kind": "ttl-setting",
@@ -528,6 +538,14 @@
         "list"
       ]
     },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "list"
+      ]
+    },
     {
       "type": "metaresource",
       "kind": "ttl-setting",
@@ -707,6 +725,14 @@
         "list"
       ]
     },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "list"
+      ]
+    },
     {
       "type": "metaresource",
       "kind": "ttl-setting",

tests/integration/tests/llmpricingrules/02_authz.py

@@ -0,0 +1,267 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import pytest
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures import types
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    add_license,
+    change_user_role,
+    create_active_user,
+)
+from fixtures.llmpricingrules import (
+    LLM_PRICING_RULES_URL,
+    delete_all_llm_pricing_rules,
+    list_llm_pricing_rules,
+    upsert_llm_pricing_rules,
+)
+from fixtures.role import find_role_by_name, transaction_group
+
+user_password = "password123Z$"
+editor_email = "llm-pricing-editor@integration.test"
+viewer_email = "llm-pricing-viewer@integration.test"
+updater_role = "llm-pricing-updater"
+updater_email = "llm-pricing-updater@integration.test"
+scoped_role = "llm-pricing-scoped"
+scoped_email = "llm-pricing-scoped@integration.test"
+
+PROBE_RULE = {
+    "modelName": "authz-probe",
+    "provider": "OpenAI",
+    "modelPattern": ["authz-probe*"],
+    "unit": "per_million_tokens",
+    "pricing": {"input": 1, "output": 2},
+    "isOverride": True,
+    "enabled": True,
+}
+
+OTHER_RULE = {
+    "modelName": "authz-probe-other",
+    "provider": "Anthropic",
+    "modelPattern": ["authz-probe-other*"],
+    "unit": "per_million_tokens",
+    "pricing": {"input": 3, "output": 4},
+    "isOverride": True,
+    "enabled": True,
+}
+
+
+def test_setup(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+) -> None:
+    add_license(signoz, make_http_mocks, get_token)
+
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    delete_all_llm_pricing_rules(signoz, admin_token)
+    assert upsert_llm_pricing_rules(signoz, admin_token, [PROBE_RULE, OTHER_RULE]).status_code == HTTPStatus.NO_CONTENT
+    probe_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+
+    create_active_user(signoz, admin_token, email=editor_email, role="signoz-editor", password=user_password)
+    create_active_user(signoz, admin_token, email=viewer_email, role="signoz-viewer", password=user_password)
+
+    create_role(admin_token, updater_role, [transaction_group("update", "metaresource", "llm-pricing-rule", ["*"])])
+    updater = create_active_user(signoz, admin_token, email=updater_email, role="signoz-viewer", password=user_password)
+    change_user_role(signoz, admin_token, updater, "signoz-viewer", updater_role)
+
+    create_role(
+        admin_token,
+        scoped_role,
+        [
+            transaction_group("read", "metaresource", "llm-pricing-rule", [probe_id]),
+            transaction_group("update", "metaresource", "llm-pricing-rule", [probe_id]),
+            transaction_group("delete", "metaresource", "llm-pricing-rule", [probe_id]),
+        ],
+    )
+    scoped = create_active_user(signoz, admin_token, email=scoped_email, role="signoz-viewer", password=user_password)
+    change_user_role(signoz, admin_token, scoped, "signoz-viewer", scoped_role)
+
+
+@pytest.mark.parametrize(
+    "path",
+    [LLM_PRICING_RULES_URL, f"{LLM_PRICING_RULES_URL}/unmapped_models"],
+    ids=["list", "unmapped_models"],
+)
+@pytest.mark.parametrize(
+    ("email", "expected"),
+    [
+        (USER_ADMIN_EMAIL, HTTPStatus.OK),
+        (editor_email, HTTPStatus.OK),
+        (viewer_email, HTTPStatus.OK),
+        (updater_email, HTTPStatus.FORBIDDEN),
+        (scoped_email, HTTPStatus.FORBIDDEN),
+    ],
+    ids=["admin", "editor", "viewer", "updater", "scoped"],
+)
+def test_reads_need_list_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    path: str,
+    email: str,
+    expected: HTTPStatus,
+) -> None:
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(path),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:list" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "model_name", "expected"),
+    [
+        (USER_ADMIN_EMAIL, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (editor_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (viewer_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
+    ],
+    ids=["admin", "editor", "viewer", "updater", "scoped_granted", "scoped_other"],
+)
+def test_get_needs_read_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    model_name: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:read" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "expected"),
+    [
+        (editor_email, HTTPStatus.FORBIDDEN),
+        (viewer_email, HTTPStatus.FORBIDDEN),
+        (scoped_email, HTTPStatus.NO_CONTENT),
+        (updater_email, HTTPStatus.NO_CONTENT),
+        (USER_ADMIN_EMAIL, HTTPStatus.NO_CONTENT),
+    ],
+    ids=["editor", "viewer", "scoped", "updater", "admin"],
+)
+def test_upsert_needs_update_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = upsert_llm_pricing_rules(signoz, token, [{**PROBE_RULE, "id": rule_id}])
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:update" in response.text
+
+
+@pytest.mark.parametrize(
+    "shape",
+    ["other_rule", "create", "sync_row", "own_and_other"],
+    ids=["other_rule", "create", "sync_row", "own_and_other"],
+)
+def test_upsert_scoped_to_granted_rule(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    shape: str,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rules = {r["modelName"]: r for r in list_llm_pricing_rules(signoz, admin_token)}
+    own = {**PROBE_RULE, "id": rules[PROBE_RULE["modelName"]]["id"]}
+    other = {**OTHER_RULE, "id": rules[OTHER_RULE["modelName"]]["id"]}
+    sync_row = {**{k: v for k, v in PROBE_RULE.items() if k != "isOverride"}, "sourceId": "11111111-1111-4111-8111-111111111199"}
+    bodies = {"other_rule": [other], "create": [PROBE_RULE], "sync_row": [sync_row], "own_and_other": [own, other]}
+
+    response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), bodies[shape])
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+    assert "llm-pricing-rule:update" in response.text
+
+
+def test_revoke_update_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, scoped_role)}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "llm-pricing-rule", [rule_id]),
+                transaction_group("delete", "metaresource", "llm-pricing-rule", [rule_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=10,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), [{**PROBE_RULE, "id": rule_id}])
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+    assert "llm-pricing-rule:update" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "model_name", "expected"),
+    [
+        (editor_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (viewer_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, PROBE_RULE["modelName"], HTTPStatus.NO_CONTENT),
+        (USER_ADMIN_EMAIL, OTHER_RULE["modelName"], HTTPStatus.NO_CONTENT),
+    ],
+    ids=["editor", "viewer", "updater", "scoped_other", "scoped_granted", "admin"],
+)
+def test_delete_needs_delete_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    model_name: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:delete" in response.text
+
+
+def test_cleanup(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    delete_all_llm_pricing_rules(signoz, get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD))