oh, ok, I got the problem now. First of all the user should not be able to see the index pattern they are not allowed to see. It can be solved with a custom kibana index per group. Like this: ror-sandbox/ror-demo-cluster/conf/readonlyrest.yml at 029be185dd4146f46bf49f215e258ff6f6437e48 · beshu-tech/ror-sandbox · GitHub
Sadly in ROR 1.56.0 there is a bug related to this problem. We have it already solved in RC of 1.57.0. I’ve added the new plugins to the repo if you would like to try it.