diff --git a/docs/use-cases/observability/clickstack/deployment/hyperdx-clickhouse-cloud.md b/docs/use-cases/observability/clickstack/deployment/hyperdx-clickhouse-cloud.md
index 4b613971e4e..9899f1ea093 100644
--- a/docs/use-cases/observability/clickstack/deployment/hyperdx-clickhouse-cloud.md
+++ b/docs/use-cases/observability/clickstack/deployment/hyperdx-clickhouse-cloud.md
@@ -18,6 +18,7 @@ import hyperdx_cloud_landing from '@site/static/images/use-cases/observability/h
 import hyperdx_cloud_datasource from '@site/static/images/use-cases/observability/hyperdx_cloud_datasource.png';
 import hyperdx_create_new_source from '@site/static/images/use-cases/observability/hyperdx_create_new_source.png';
 import hyperdx_create_trace_datasource from '@site/static/images/use-cases/observability/hyperdx_create_trace_datasource.png';
+import read_only from '@site/static/images/clickstack/read-only-access.png';
 import { TrackedLink } from '@site/src/components/GalaxyTrackedLink/GalaxyTrackedLink';
 
 <PrivatePreviewBadge/>
@@ -286,6 +287,25 @@ For users looking to explore the HyperDX interface only, we recommend our [sampl
 
 <Image img={hyperdx_cloud_landing} alt="ClickHouse Cloud HyperDX Landing" size="lg"/>
 
+### User permissions {#user-permissions}
+
+Users accessing HyperDX are automatically authenticated using their ClickHouse Cloud console credentials. Access is controlled through SQL console permissions configured in the service settings.
+
+#### To configure user access {#configure-access}
+
+1. Navigate to your service in the ClickHouse Cloud console
+2. Go to **Settings** → **SQL Console Access**
+3. Set the appropriate permission level for each user:
+   - **Service Admin → Full Access** - Required for enabling alerts
+   - **Service Read Only → Read Only** - Can view observability data and create dashboards
+   - **No access** - Cannot access HyperDX
+
+<Image img={read_only} alt="ClickHouse Cloud Read Only"/>
+
+:::important Alerts require admin access
+To enable alerts, at least one user with **Service Admin** permissions (mapped to **Full Access** in the SQL Console Access dropdown) must log into HyperDX at least once. This provisions a dedicated user in the database that runs alert queries.
+:::
+
 ### Create a data source {#create-a-datasource}
 
 HyperDX is Open Telemetry native but not Open Telemetry exclusive - users can use their own table schemas if desired.
diff --git a/static/images/clickstack/read-only-access.png b/static/images/clickstack/read-only-access.png
new file mode 100644
index 00000000000..85ff9c10213
Binary files /dev/null and b/static/images/clickstack/read-only-access.png differ