I still think "insights" is a weird auth context to use here.
Why did we choose this again @SasSwart?

@dannykopping
Basically we have 3 actions:

• Read Template.All()
• Use Template.All()
• ViewInsights Template.All()

Read is for reading the content of template
Use is for creating workspaces
ViewInsights is for gathering stats & metrics across templates

Looks like GetPresetsBackoff falls into ViewInsights category - because we gathering statistics across all template presets, calculating number of failed builds, etc...

I had a discussion with Steven regarding this, but I'm open to suggestions.

Repurposing other RBAC roles just because they overlap logically feels like a bad design choice.
Each feature should have its own RBAC policy.

We can introduce new resource type here: https://github.com/coder/coder/blob/main/coderd/rbac/object_gen.go

Then use it like this:

if err := q.authorizeContext(ctx, policy.ActionViewInsights, rbac.ResourcePrebuilds.All()); err != nil {}

Optionally introduce new action type as well, and use it like this:

if err := q.authorizeContext(ctx, policy.ActionCollectStatistics, rbac.ResourcePrebuilds.All()); err != nil {}

But I think we don't want to introduce too many action types.

cc @Emyrk

We can do this in a follow-up, by the way 👍

I don't have all the context for prebuilds. Can we throw a quick disc chat on the calendar?