I wasnt entirely clear in my previous comment, grafana allowed clients to issue full queries against all datasources the user has access to. So if you have one datasource with metrics of all your users and want to give them access to dashboards that only display their own data, that is not secure.