@@ -170,15 +170,16 @@ integration-read add-ons, and cluster-wide `get/list/watch` on Secrets.
 Helm release alerts and Secret changes in the timeline need Secret read;
 Helm stores releases as Secrets. The grant includes no writes.
 
-### Radar Cloud automatic Diagnose (`radar:ai`)
+### Radar Cloud automatic Diagnose (`radar:ai:reader`)
 
 Manual Diagnose turns read as the person who started them. Radar Cloud forwards
-that person's identity and groups; `radar:ai` is not involved. MCP clients also
-read with the user's own permissions.
+that person's identity and groups; `radar:ai:reader` is not involved. MCP clients
+also read with the user's own permissions.
 
-Automatic (alert-triggered) Diagnose runs read as `radar:ai` only, a permanent
-read-only background diagnostic reader. Never grant this group write
-permissions; a future write-capable feature needs its own group.
+Automatic (alert-triggered) Diagnose runs use username `radar:ai:<org>` and
+group `radar:ai:reader` only, a permanent read-only background diagnostic reader.
+Never grant this group write permissions; a future write-capable AI identity
+needs a separate opt-in group (e.g. `radar:ai:operator`).
 `cloud.aiRbac` (default `true`) creates the chart's default grant: a chart-owned
 role aggregated to match `view` plus the cluster-read and integration-read
 add-ons. With the standard `view` role this grant includes no Kubernetes Secret
 
@@ -89,7 +89,7 @@ false
 {{- end -}}
 
 {{/*
-Whether the default read grant for automatic Diagnose (radar:ai) renders.
+Whether the default read grant for automatic Diagnose (radar:ai:reader) renders.
 An absent value means OFF, as with radar.cloudSystemRbac: a
 `--reuse-values` upgrade from a release that predates the key never gains a
 new reader without someone choosing it.
 
@@ -1,10 +1,11 @@
 {{- /*
 Read-only access for automatic (alert-triggered) Radar Cloud Diagnose runs.
 
-Automatic runs read as radar:ai only. Manual turns read as the person who
-started them, with that person's identity and groups forwarded by Radar Cloud;
-radar:ai is not involved. Keep radar:ai permanently read-only; any future
-write-capable feature needs its own group.
+Automatic runs use username radar:ai:<org> and group radar:ai:reader only.
+Manual turns read as the person who started them, with that person's identity
+and groups forwarded by Radar Cloud; radar:ai:reader is not involved. Keep
+radar:ai:reader permanently read-only; a future write-capable AI identity needs
+a separate opt-in group (e.g. radar:ai:operator).
 
 The default grant is view plus the cluster-read and integration-read add-ons.
 With the standard view role it grants no Kubernetes Secret permission; it
@@ -44,6 +45,6 @@ roleRef:
   name: {{ include "radar.fullname" . }}-cloud-ai-read
 subjects:
   - kind: Group
-    name: radar:ai
+    name: radar:ai:reader
     apiGroup: rbac.authorization.k8s.io
 {{- end -}}
@@ -206,7 +206,7 @@ roleRef:
   name: {{ $fullname }}-cluster-read
 subjects:
   - kind: Group
-    name: radar:ai
+    name: radar:ai:reader
     apiGroup: rbac.authorization.k8s.io
 {{- end }}
 {{- end -}}
@@ -51,7 +51,7 @@ roleRef:
   name: {{ $name }}
 subjects:
   - kind: Group
-    name: radar:{{ $tier }}
+    name: radar:{{ if eq $tier "ai" }}ai:reader{{ else }}{{ $tier }}{{ end }}
     apiGroup: rbac.authorization.k8s.io
 {{- if not (has $tier (list "system" "ai")) }}
   - kind: Group
 
@@ -1,4 +1,4 @@
-suite: Cloud radar:ai RBAC
+suite: Cloud radar:ai:reader RBAC
 templates:
   - cloud-rbac-ai.yaml
   - cloud-rbac-cluster-read.yaml
@@ -35,7 +35,7 @@ tests:
       - notExists:
           path: metadata.labels["rbac.authorization.k8s.io/aggregate-to-admin"]
 
-  - it: binds only radar:ai to the owned read role
+  - it: binds only radar:ai:reader to the owned read role
     template: cloud-rbac-ai.yaml
     documentIndex: 1
     asserts:
@@ -54,10 +54,10 @@ tests:
           path: subjects
           value:
             - kind: Group
-              name: radar:ai
+              name: radar:ai:reader
               apiGroup: rbac.authorization.k8s.io
 
-  - it: keeps radar:ai's read grant when the tier bindings are off
+  - it: keeps radar:ai:reader's read grant when the tier bindings are off
     set:
       cloud.defaultRbac.create: false
     template: cloud-rbac-ai.yaml
@@ -67,7 +67,7 @@ tests:
           count: 2
       - equal:
           path: subjects[0].name
-          value: radar:ai
+          value: radar:ai:reader
 
   # --reuse-values from a release predating aiRbac renders with the key
   # absent: nothing renders, so an existing install never gains a new reader
@@ -104,7 +104,7 @@ tests:
       - hasDocuments:
           count: 0
 
-  - it: binds radar:ai to no Secret role
+  - it: binds radar:ai:reader to no Secret role
     set:
       cloud.defaultRbac.create: false
     template: cloud-rbac-ai.yaml
@@ -118,7 +118,7 @@ tests:
           path: roleRef.name
           value: RELEASE-NAME-radar-cloud-ai-read
 
-  - it: gives radar:ai the cluster-read add-on without the tiers
+  - it: gives radar:ai:reader the cluster-read add-on without the tiers
     set:
       cloud.defaultRbac.create: false
       cloud.systemRbac: false
@@ -142,11 +142,11 @@ tests:
           path: subjects
           value:
             - kind: Group
-              name: radar:ai
+              name: radar:ai:reader
               apiGroup: rbac.authorization.k8s.io
         documentIndex: 1
 
-  - it: gives radar:ai the cluster-read add-on beside the tiers
+  - it: gives radar:ai:reader the cluster-read add-on beside the tiers
     template: cloud-rbac-cluster-read.yaml
     documentSelector:
       path: metadata.name
@@ -156,7 +156,7 @@ tests:
           path: roleRef.name
           value: RELEASE-NAME-radar-cluster-read
 
-  - it: drops radar:ai's cluster-read binding when aiRbac is false
+  - it: drops radar:ai:reader's cluster-read binding when aiRbac is false
     set:
       cloud.aiRbac: false
     template: cloud-rbac-cluster-read.yaml
@@ -165,11 +165,11 @@ tests:
           path: subjects
           content:
             kind: Group
-            name: radar:ai
+            name: radar:ai:reader
             apiGroup: rbac.authorization.k8s.io
           any: true
 
-  - it: gives radar:ai both integration-read add-ons without the tiers
+  - it: gives radar:ai:reader both integration-read add-ons without the tiers
     set:
       cloud.defaultRbac.create: false
       cloud.systemRbac: false
@@ -181,7 +181,7 @@ tests:
           path: subjects
           value:
             - kind: Group
-              name: radar:ai
+              name: radar:ai:reader
               apiGroup: rbac.authorization.k8s.io
         documentSelector:
           path: metadata.name
@@ -190,13 +190,13 @@ tests:
           path: subjects
           value:
             - kind: Group
-              name: radar:ai
+              name: radar:ai:reader
               apiGroup: rbac.authorization.k8s.io
         documentSelector:
           path: metadata.name
           value: RELEASE-NAME-radar-cloud-ai-integration-read-cluster
 
-  - it: gives radar:ai the integration-read add-ons beside the tiers
+  - it: gives radar:ai:reader the integration-read add-ons beside the tiers
     template: cloud-rbac-integration-read.yaml
     documentSelector:
       path: metadata.name
 
@@ -6,7 +6,7 @@ set:
   cloud.token: dummy
   cloud.url: wss://cloud.example
   cloud.clusterName: test
-  # Tier behavior only; radar:system's and radar:ai's own bindings are covered
+  # Tier behavior only; radar:system's and radar:ai:reader's own bindings are covered
   # below, in cloud_rbac_system_test.yaml and in cloud_rbac_ai_test.yaml.
   cloud.systemRbac: false
   cloud.aiRbac: false
 
@@ -529,14 +529,16 @@ cloud:
   # False or absent (e.g. an older --reuse-values install) creates no default
   # grant; customer bindings remain. This is not a feature switch.
   systemRbac: true
-  # Create the default read grant for radar:ai, used only by automatic
-  # (alert-triggered) Diagnose runs. Manual turns read as the person who started
-  # them; Radar Cloud forwards that person's identity and groups.
+  # Create the default read grant for radar:ai:reader, used only by automatic
+  # (alert-triggered) Diagnose runs with username radar:ai:<org>. Manual turns
+  # read as the person who started them; Radar Cloud forwards that person's
+  # identity and groups.
   # Includes view via a chart-owned aggregated role and the cluster-read and
   # integration-read add-ons. No Kubernetes Secret permission with the standard
   # view role (it inherits anything added to view via aggregate-to-view); pod
-  # logs and ConfigMaps are readable and may contain sensitive data. Keep radar:ai
-  # permanently read-only; future write-capable features need their own group.
+  # logs and ConfigMaps are readable and may contain sensitive data. Keep
+  # radar:ai:reader permanently read-only; a future write-capable AI identity
+  # needs a separate opt-in group (e.g. radar:ai:operator).
   # Independent of defaultRbac. False or absent (e.g. an older --reuse-values
   # install) creates no default grant; customer bindings remain. Radar Cloud
   # controls whether Diagnose runs; this is not a feature switch.
 
@@ -233,7 +233,7 @@ Under cloud-mode (`RADAR_CLOUD_MODE=true`, set automatically by the chart when `
 - Ships three default ClusterRoleBindings mapping Cloud's `radar:owner` / `radar:member` / `radar:viewer` groups to the standard K8s `admin` / `edit` / `view` ClusterRoles. Configurable via `cloud.defaultRbac.*` in `values.yaml`.
 - Adds a **cluster-read add-on** (`cloud.defaultRbac.clusterScopedRead.{viewer,member,owner}`, each default on) granting `get/list/watch` on infrastructure the built-in `view`/`edit`/`admin` roles exclude — Nodes, PersistentVolumes, StorageClasses, IngressClasses, PriorityClasses, RuntimeClasses, ClusterTrustBundles, CRDs, and admission webhook configurations — plus list-only Upgrade impact evidence for CSIDrivers, CSIStorageCapacities, legacy PodSecurityPolicies, and API flow-control configuration. When the matching collection is enabled, it also grants APIServices, PrometheusRules, Karpenter kinds, and node metrics. It does not grant Secrets, RBAC objects, API-server metrics, or kubelet proxy access. It's an independent axis per tier: set a tier `false` to make it namespaced-only (e.g. `clusterScopedRead.viewer: false`). Owner node cordon/drain is a separate cluster-scoped *write*, off by default (`cloud.defaultRbac.nodeOps`).
 - Creates the default read grant for `radar:system`, Radar Cloud's alerts worker and timeline puller: a chart-owned role aggregated to match `view`, the cluster-read and integration-read add-ons, and cluster-wide Secret read. Helm release alerts and Secret changes in the timeline need Secret read; Helm stores releases as Secrets. No writes. Controlled by `cloud.systemRbac` (default `true`).
-- Creates the default read grant for automatic (alert-triggered) Diagnose runs, which read as `radar:ai` only: a chart-owned role aggregated to match `view` plus the cluster-read and integration-read add-ons. No Kubernetes Secret permission or writes with the standard `view` role (the aggregated role also inherits anything your cluster adds to `view`); pod logs and ConfigMaps are readable and may contain sensitive data. Keep `radar:ai` permanently read-only; a future write-capable feature needs its own group. Controlled by `cloud.aiRbac` (default `true`). Manual Diagnose turns read as the person who started them, with that person's identity and groups forwarded by Radar Cloud; `radar:ai` is not involved. MCP clients also read with the user's own permissions.
+- Creates the default read grant for automatic (alert-triggered) Diagnose runs, which use username `radar:ai:<org>` and group `radar:ai:reader` only: a chart-owned role aggregated to match `view` plus the cluster-read and integration-read add-ons. No Kubernetes Secret permission or writes with the standard `view` role (the aggregated role also inherits anything your cluster adds to `view`); pod logs and ConfigMaps are readable and may contain sensitive data. Keep `radar:ai:reader` permanently read-only; a future write-capable AI identity needs a separate opt-in group (e.g. `radar:ai:operator`). Controlled by `cloud.aiRbac` (default `true`). Manual Diagnose turns read as the person who started them, with that person's identity and groups forwarded by Radar Cloud; `radar:ai:reader` is not involved. MCP clients also read with the user's own permissions.
 - Treats `cloud.aiRbac` and `cloud.systemRbac` as controls for the chart's default grants, independent of `cloud.defaultRbac`. False or absent (including a plain `--reuse-values` upgrade from an older chart) creates no default grant and leaves customer-created bindings untouched. These are not feature switches; Radar Cloud controls whether Diagnose runs. Without any grant, the background group has no cluster access; automatic Diagnose has no viewer fallback.
 - Requires cluster-admin-equivalent authority or `escalate` on ClusterRoles to create or update the AI/system aggregated roles, in addition to normal chart installation permissions. Restricted installers can set `cloud.aiRbac=false` and `cloud.systemRbac=false` and supply their own read-only group bindings.
 - Uses the Cloud role (`radar:owner` / `radar:member` / `radar:viewer`) only to gate Radar's own configuration (settings, integrations, audit settings, registered OCI chart sources, self-upgrade), which runs as Radar's ServiceAccount. A Cloud request with no role group (such as the Hub's `radar:system` background identity) is refused there. Operations that run as the impersonated user — Helm reads and writes, in-cluster probe pods — are decided by Kubernetes RBAC alone.
 
@@ -174,7 +174,7 @@ func TestIntegrationReadBindings(t *testing.T) {
 		name, overrides      string
 		namespaced, cluster  []string
 		removeMap, removeKey bool
-		// radar:system and radar:ai are bound whenever cloud mode renders
+		// radar:system and radar:ai:reader are bound whenever cloud mode renders
 		// RBAC at all, independent of the tier settings.
 		noSystem, noAI bool
 	}{
@@ -231,8 +231,12 @@ func TestIntegrationReadBindings(t *testing.T) {
 							continue
 						}
 						found = true
-						wantSubjects := []rbacv1.Subject{{Kind: "Group", Name: "radar:" + tier, APIGroup: rbacv1.GroupName}}
-						// radar:system and radar:ai have no legacy cloud:* twin.
+						group := "radar:" + tier
+						if tier == "ai" {
+							group = "radar:ai:reader"
+						}
+						wantSubjects := []rbacv1.Subject{{Kind: "Group", Name: group, APIGroup: rbacv1.GroupName}}
+						// radar:system and radar:ai:reader have no legacy cloud:* twin.
 						if tier != "system" && tier != "ai" {
 							wantSubjects = append(wantSubjects, rbacv1.Subject{Kind: "Group", Name: "cloud:" + tier, APIGroup: rbacv1.GroupName})
 						}