Best Practice in RBAC to give views to tenant apps

[Skins]

In a RBAC scenario where there are multiple tenants .
How to control access to their apps so that 'User A' who belongs to 'Role A' and when they log into Splunk all they see is 'Role A' App and no other Apps which are on that system ?

Similarly 'User B' who belongs to 'Role B' and when they log into Splunk all they see is 'Role B' App or Apps

And we can also Add a User C that inherits from Role A & B - and when they log in all they have is visibility of App A and AppB and none of the other Apps show in the Splunk GUI ?

Gratzi

[rglennacn]

It seems there are multiple ways to do this (e.g. index filters or search filters tied to a role). As far as best practices, I think a major question is how these filters might affect performance. E.g. if we have, say, over 1k roles, and each role has a unique search filter all with access to the same index, will we start hitting significant performance slowdowns?
I've seen assertions that "search filters" have performance implications, but I haven't been able to find any specific dimensions that would impact the performance (e.g. # of filters, cardinality of filtered index, etc).

[adonio]

@rglennacn commented regarding access to data.
my understanding is that you are asking regarding apps permissions. if this is the case, the permissions are set on the app level. go to the "manage apps" page (if single SH) or modify the local.meta (both single or SHC) and configure the permissions as you desire. if Role A can see (read and write OR read only) App1, App2, and App3, they will be visible and accessible to the users that have that role on the navigation menu, same goes to Role B users and Apps 4,5,6. Users who have both roles, will be able to see all apps.
in general, RBAC in Splunk works like Union, so AB = (A U B)

[rglennacn]

@adonio thank you for your response. I am looking into this, and it does look like it might be at least part of the solution.
Just so I'm clear, if one were to modify the local.meta file for a role associated with (in our case) the Add-on for GCP, would those logs only be available in the Search & Reporting (i.e. default search) app for users with that role?
We will have multiple workloads (managed by distinct teams and with varying levels of confidentiality), and the logs generated by these workloads must be isolated to the development teams.